redline | 56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2

Analysis

max time kernel
289s
max time network
302s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 09:30

Target

56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe
Size

2.4MB
MD5

99bf74cbcf813be1e78782fcb2d416fd
SHA1

1fcbea028dc9168f5c779efaf2c343f4eab29740
SHA256

56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2
SHA512

8f0c5077b6247fc7cd7e32cd6f3c6c38924cbabe0c6272eaf2c25b3a13ea54d965b55ac417cb25804b57d670610c4ce2cb8708864f30b310942db2cee76922e3
SSDEEP

24576:OQN9g7YcYbFRbY8MKKlx0g+Y4Y27V9OZYUya4tLfTsLtSaLA3JPNaKpl3RuQ5538:h9xiD2Na4tLfTsnUl3Q

Score

10^/10

Family

redline

Botnet

@Ler0is

185.106.92.226:40788

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/148592-56-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/148592-61-0x00000000000AADBE-mapping.dmp	family_redline
behavioral1/memory/148592-63-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/1972-64-0x0000000000400000-0x000000000055D000-memory.dmp	family_redline
behavioral1/memory/148592-62-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28
PID 1972 wrote to memory of 148592	1972	56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe	28

C:\Users\Admin\AppData\Local\Temp\56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe
"C:\Users\Admin\AppData\Local\Temp\56a417a3d073f7d5dd56de99ba1f515f9b2a5e45021db0fee7af952613d402e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:148592

memory/1972-64-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/148592-54-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/148592-56-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/148592-63-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/148592-62-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/148592-65-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download