redline | 2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912

Analysis

max time kernel
300s
max time network
303s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 08:54

Target

2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe
Size

2.5MB
MD5

a96950e973081e1145547d3c5bcac94f
SHA1

3d72c767397db4498a4ab7cda505f8a1fcc7ba4b
SHA256

2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912
SHA512

c824a162d019b0c272c14b3bfa5cc75d8ca8662025c36358194f84163b95f95b5263b64da5c7e1e942d395a438f3d1d8843319f479d9f7a99cf190d7114ee03a
SSDEEP

24576:PhHmC8/16YWYxwFeFuIMXBdNfx6cDBobmY6TjR2bRQir/0LMzjhdqUl3RuQ5531+:Pf8/39JR6sRQir/0Y5d5l34

Score

10^/10

Family

redline

Botnet

top1

pemararslava.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe

description	pid	process	target process
PID 1980 set thread context of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe

description	pid	process	target process
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe
PID 1980 wrote to memory of 195128	1980	2ee10299431f2d13208b63912ca6482751c013dc18f0b9245562d758a62af912.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:195128

memory/195128-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/195128-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/195128-61-0x000000000041817E-mapping.dmp

Download
memory/195128-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/195128-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/195128-64-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download