redline | 197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e

Analysis

max time kernel
287s
max time network
302s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 08:33

Target

197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe
Size

2.4MB
MD5

7307c98660d32195848437e6448f79c7
SHA1

a051f24ebce8dc2739efb4303af66ec9c5ed7b35
SHA256

197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e
SHA512

45344233c9fb8fdb575ef4e5675512f00cb97010e136f1c56b6f98149b3ca46f3c2644ebeae730ca856c67d404b58eab880855f7486caa181130323f692cc8f3
SSDEEP

24576:JtJlEpYcY1l7bgwMLClDxCJrMGH5O50cyfMLLML6LdSRfR8bGNepb8l3RuQ55319:NlruMGPfMLLML6Mk8l3L

Score

10^/10

Family

redline

193.124.22.4:39946

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/130880-56-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/130880-61-0x00000000000AB50E-mapping.dmp	family_redline
behavioral1/memory/130880-62-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/130880-63-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28
PID 1768 wrote to memory of 130880	1768	197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe	28

C:\Users\Admin\AppData\Local\Temp\197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe
"C:\Users\Admin\AppData\Local\Temp\197773ef9ce31a71b841c5eb083f397911e4060f1f83e6b543840988e3fa8a8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:130880

memory/130880-54-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/130880-56-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/130880-62-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/130880-63-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/130880-64-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download