redline | be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83

Analysis

max time kernel
291s
max time network
297s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 11:03

Target

be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe
Size

2.4MB
MD5

4835be0ef77bb1d16d6c5d47e16a19f4
SHA1

bafa45af0c221164e628f8bbcf2e1fd814feb7be
SHA256

be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83
SHA512

abf03bed395db3aec232321512134134f69b17555454ae8d2cb816a7a54d1e94f291704a6aa76e63b6af6c92184577cfc47794a812391fd65d5f29898f40e411
SSDEEP

24576:DW6iROIn1jY/YLB0bB4Mval0XkBsly8mecGgZ7ZcoxOmisl+L60zl3RuQ55313e:SROInvMEepMtdOmisl+zl3k

Score

10^/10

Family

redline

185.200.191.18:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/146036-56-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/146036-61-0x00000000000AA7CE-mapping.dmp	family_redline
behavioral1/memory/146036-63-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/146036-62-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28
PID 1096 wrote to memory of 146036	1096	be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe	28

C:\Users\Admin\AppData\Local\Temp\be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe
"C:\Users\Admin\AppData\Local\Temp\be46994b96693ea00a62580ec9db087a1cca5da13ce7fff730e5b13d73dd2a83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:146036

memory/146036-56-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/146036-54-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/146036-61-0x00000000000AA7CE-mapping.dmp

Download
memory/146036-63-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/146036-62-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/146036-64-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download