redline | 0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa

Analysis

max time kernel
289s
max time network
304s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 08:26

Target

0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe
Size

2.4MB
MD5

64c818e6bf960cded14b063e90dcba15
SHA1

45a59649987f64e01a8465626bb13166f1c2e62c
SHA256

0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa
SHA512

c8734967e707cf2ce1ae05d35d04189d5f7d2d0febe371300349ae8b826f5c5eb0c38cb92fccb4af9534b00153d2b8caa4f4264488f01f36ca9ec710713fa156
SSDEEP

24576:U2jcZqpYAYt7OSCSMnSo6ert+i16mcv+ioIp6r3ZMh0SLh4RIVal3RuQ55313n:U2oZbmxcmzIp6r3ZQ0Slul3p

Score

10^/10

Family

redline

185.148.39.219:47029

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/141992-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/141992-61-0x000000000041B50E-mapping.dmp	family_redline
behavioral1/memory/141992-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/141992-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28
PID 1760 wrote to memory of 141992	1760	0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe	28

C:\Users\Admin\AppData\Local\Temp\0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe
"C:\Users\Admin\AppData\Local\Temp\0eb0e703f97a3aa89081f583fed6cd8b3312804cae4f166aeaf354278842afaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:141992

memory/141992-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/141992-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/141992-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/141992-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/141992-64-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download