redline | f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d

Analysis

max time kernel
297s
max time network
300s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/11/2022, 11:53

Target

f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe
Size

2.5MB
MD5

2043d051a8aa5175259eeb6304df06be
SHA1

0824f696eb377f8df25c2fa4b58476b2377d75e6
SHA256

f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d
SHA512

73271d294f2a0a5d4a9df675e15c5507fdf87b86589367a79c9af75ebad5751638cf92e03421d8e3b2b178c2aa10887a67e94cda1240d5c5dd3d0ed57ef62afb
SSDEEP

24576:0JVAP8k048AYQYtWGcXitMSndI1HeuSsbGx6nf4i8ELcZnl3RuQ55313T:0rk8k04iW9fnf4i8EUl3x

Score

10^/10

Family

redline

185.215.113.25:27757

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/183472-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/183472-61-0x000000000041B50E-mapping.dmp	family_redline
behavioral1/memory/183472-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/183472-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 932 set thread context of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28
PID 932 wrote to memory of 183472	932	f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe	28

C:\Users\Admin\AppData\Local\Temp\f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe
"C:\Users\Admin\AppData\Local\Temp\f96042e4fc92294214d5e5af42b093cd7ec7476db19baeb6d0c257c05623e19d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:183472

memory/183472-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/183472-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/183472-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/183472-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/183472-64-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download