redline | 71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6

Analysis

max time kernel
297s
max time network
306s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 09:57

Target

71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe
Size

2.5MB
MD5

ae4706a07a1483095cbb7d21d9bb15ef
SHA1

b4cea0e55de6af32949301b217f73a5b3b2c5e4c
SHA256

71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6
SHA512

2c2f34cc43fe898f453b40a46b1f3bd96a74bc6882634b71675ae25d65cfc1f0e2863a99803c4edd3275012a8afbfb89492b0c0169bc3569ca967d6bab2c375d
SSDEEP

24576:tZKcYhEYcwpYQYC+aQXi3MKbdIRHGOw6bdgvTLesl1oho4yQALwrkl3RuQ55313w:tAnhjck+Jdbhho4yQAll3q

Score

10^/10

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

193.233.193.14:8163

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/189896-56-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/189896-61-0x00000000000AAE1A-mapping.dmp	family_redline
behavioral1/memory/189896-62-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/189896-63-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe

description	pid	process	target process
PID 1504 set thread context of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe

description	pid	process	target process
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe
PID 1504 wrote to memory of 189896	1504	71db9fe75ae7ee5e107682e5df9a108a92f174e0368105728843c37598c1cab6.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:189896

memory/189896-54-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/189896-56-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/189896-61-0x00000000000AAE1A-mapping.dmp

Download
memory/189896-62-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/189896-63-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/189896-64-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download