redline | b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2

Analysis

max time kernel
37s
max time network
40s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 10:53

Target

b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe
Size

2.4MB
MD5

9bbd4395f60dcef8bf4031657c36ceb9
SHA1

ebb3de7fa49655d2936cd426dc8b6e6ffeefe1ca
SHA256

b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2
SHA512

4ac276f598907ea851b6caad9adb692ce681e52339d0ac650535bd4fe796795736ebccfa066e4418ab8c9a4acb738bf85f01609a8979677d77cfe33c706b6631
SSDEEP

24576:0b33YaYeUrGq9MI+oXDroMohelJlwHQBHpdJyqAL7ll3RuQ55313g:0ba1RJKwBHpdJyqANl3e

Score

10^/10

Family

redline

193.124.22.4:39946

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/148576-56-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28
PID 1192 wrote to memory of 148576	1192	b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe	28

C:\Users\Admin\AppData\Local\Temp\b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe
"C:\Users\Admin\AppData\Local\Temp\b43c61fe352b7147d203c0117911335771d908e3a66971d5ee0e243aa85007e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:148576

memory/148576-54-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/148576-56-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download