redline | 9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7

Analysis

max time kernel
300s
max time network
319s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 10:31

Target

9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe
Size

2.4MB
MD5

eab5b84b8a95af191249140195c0fc96
SHA1

be17f14d1ddf897f67329b9fd1fc0c2bd3784877
SHA256

9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7
SHA512

39c75787232f3294cf298a4c851d3a687909409ba1946ca13f9e26cdcf9dec14c6034a09fa6ff467962bc4e0a407042154b381c2e299f01740e65b8c065e688d
SSDEEP

24576:uWaIgjWkZAY/Y1MWbB91Mr8l0rimDc5/RS38lo8VEFianILsD67l3RuQ55313J:1kAzJk2VEFianIT7l33

Score

10^/10

Family

redline

152.89.219.248:19932

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29
PID 1968 wrote to memory of 148616	1968	9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe	29

C:\Users\Admin\AppData\Local\Temp\9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe
"C:\Users\Admin\AppData\Local\Temp\9cb88403480481561a8a8c6c85fdee2c3cbb3b2854a45d17fe9a4459855461a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:148616

memory/1968-63-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/148616-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/148616-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/148616-61-0x000000000041734E-mapping.dmp

Download
memory/148616-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/148616-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/148616-65-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download