redline | 8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8

Analysis

max time kernel
289s
max time network
301s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 10:17

Target

8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe
Size

2.4MB
MD5

5b6ccd2fa28a546baa035950452d3b67
SHA1

aa8a337989a6b3e80764fe83cbfe31a36980e3a0
SHA256

8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8
SHA512

afb515fc540e90dff8d1acaa7864de4206a3ee7cca102ddefc7656b65928dc9a5d030d39092e49ea7d5c843fde8ef44cbe094b46939092641229e919d858e0fa
SSDEEP

24576:bAlpyq3YRYk7eP+q9/MaXo6erta9168FekfQIyrjPisuFpxL5xraol3RuQ55313j:kzyedmkF945jPisuF39nl3J

Score

10^/10

Family

redline

193.124.22.4:39946

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/147284-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/147284-61-0x000000000041B4FE-mapping.dmp	family_redline
behavioral1/memory/147284-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/147284-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28
PID 1660 wrote to memory of 147284	1660	8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe	28

C:\Users\Admin\AppData\Local\Temp\8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe
"C:\Users\Admin\AppData\Local\Temp\8ad52d3478205d6841cb495d693afd352f83ba4d6b062c2112c6b0c6604d0ea8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:147284

memory/147284-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/147284-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/147284-61-0x000000000041B4FE-mapping.dmp

Download
memory/147284-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/147284-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/147284-64-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download