redline | 3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 01:44

Target

3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe
Size

2.5MB
MD5

1d59f656530b2d362f5d540122fb2d03
SHA1

c6af89f5402210c13ac67d4fc081b015a98c0959
SHA256

3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec
SHA512

5065db582a0de1b319c25c67c40cfaff8a5240b4fc7f0dec9a7d1eac9ffaefef1f6923085a5ebcec07c91e3fdc7ff6e755847dc2e2bb27786477add0d8cf7094
SSDEEP

24576:SxHh9tivm4GY2YlYFBcFuDMGed39+aV0obd3Ve6hGpa3ibCtLHfs25dehl3RuQ5m:Sv9wvmmkJSd3gpuibCtTZdQl3U

Score

10^/10

Family

redline

45.150.108.67:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/197188-133-0x00000000001D0000-0x00000000001F0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 197188	3988	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	84

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 197188	3988	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	84
PID 3988 wrote to memory of 197188	3988	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	84
PID 3988 wrote to memory of 197188	3988	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	84
PID 3988 wrote to memory of 197188	3988	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	84
PID 3988 wrote to memory of 197188	3988	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	84

C:\Users\Admin\AppData\Local\Temp\3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe
"C:\Users\Admin\AppData\Local\Temp\3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:197188

memory/197188-133-0x00000000001D0000-0x00000000001F0000-memory.dmp

Filesize
128KB

Download
memory/197188-138-0x0000000005020000-0x0000000005638000-memory.dmp

Filesize
6.1MB

Download
memory/197188-139-0x0000000004AC0000-0x0000000004AD2000-memory.dmp

Filesize
72KB

Download
memory/197188-140-0x0000000004BF0000-0x0000000004CFA000-memory.dmp

Filesize
1.0MB

Download
memory/197188-141-0x0000000004B20000-0x0000000004B5C000-memory.dmp

Filesize
240KB

Download