redline | 874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45

Analysis

max time kernel
292s
max time network
299s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 10:15

Target

874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe
Size

2.5MB
MD5

e0be45621c059d3366108b5754221a93
SHA1

cc3d83e36b5a6cb7a6c10787e7a9a9528fdd8bf1
SHA256

874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45
SHA512

a82dcb1a89d0ab470f0071798ec89700ab07635f6a5eaf69c228d8ab6015bcc2eda56a88f6b1d6ff0a655e63cf2aa29e8429af658badc74bdd43906c724e6451
SSDEEP

24576:pJtt3ntFbZAEEvYWYfEk7FueMIBdX0eC4HgbD4spc85alUowKir/0LMnOpdjol3x:pJtt3n5AEf/gMzwKir/0Y+dcl3x

Score

10^/10

Family

redline

Botnet

@mmseven_top

185.106.92.226:40788

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/195088-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/195088-61-0x000000000041ADD2-mapping.dmp	family_redline
behavioral1/memory/195088-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/195088-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 816 set thread context of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28
PID 816 wrote to memory of 195088	816	874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe	28

C:\Users\Admin\AppData\Local\Temp\874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe
"C:\Users\Admin\AppData\Local\Temp\874886647f3106b589cd1c0c1fd33dc5b67f2276a359315a7a4557924db86e45.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:195088

memory/195088-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195088-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195088-61-0x000000000041ADD2-mapping.dmp

Download
memory/195088-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195088-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195088-64-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download