redline | b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc

Analysis

max time kernel
290s
max time network
297s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 10:53

Target

b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe
Size

2.4MB
MD5

277ca0c1fbc53470b8c0961f4ef4a17b
SHA1

f68f90e3fd479ab1058e412435b5c37deb9ca86e
SHA256

b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc
SHA512

2b664e20829e86f7c7a91c429a3c0d0dc4c5f8dc5207a52f4815c26e17d958d9c8874ea766aba245ade9b6280bf1f4a586db4e3042cd0c0d65de362a6bde0b9e
SSDEEP

24576:lG0t03XYfYvt4bROMMMlk1cxzkuS+oIoF04xiMTIL6Bel3RuQ55313n:x0bNR+20IiMTInl35

Score

10^/10

Family

redline

193.124.22.4:39946

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/148604-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/148604-61-0x000000000041B4FE-mapping.dmp	family_redline
behavioral1/memory/148604-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/148604-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28
PID 1824 wrote to memory of 148604	1824	b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe	28

C:\Users\Admin\AppData\Local\Temp\b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe
"C:\Users\Admin\AppData\Local\Temp\b446bda1c90be0a19e22b2cb6fa5a09b7ef24b2b21bc826bac9fc001307a8afc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:148604

memory/148604-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/148604-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/148604-61-0x000000000041B4FE-mapping.dmp

Download
memory/148604-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/148604-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/148604-64-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download