redline | f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f

Analysis

max time kernel
299s
max time network
315s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 11:50

Target

f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe
Size

2.4MB
MD5

7d61cbf21dcba79d3d923372d991bbce
SHA1

e716c87403da26630d5881056b51443e1a392daf
SHA256

f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f
SHA512

3ee2c574d6c289ea2395fcfb1bf18a70b112d8a3c5fadd5955512f38d3c61e3308688f9e1ddfbe6ea8f54e084867dba6d5ea65a993667e1d3bb6b938bdacca34
SSDEEP

24576:Sgyt4YcYhsxbAZaMn/ljS0ETBZOZvnM8hnp+LGtdLZSF4k3VSNW6tVl3RuQ5531I:vyqfBh8uLGtdEWVl3K

Score

10^/10

Family

redline

Botnet

45.144.29.48:8314

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe

description	pid	process	target process
PID 2004 set thread context of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe

description	pid	process	target process
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe
PID 2004 wrote to memory of 147492	2004	f576bb6691c065ce8b060fcf1891a68f35ced7ab679aa3e2e6dead535d71487f.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:147492

memory/147492-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/147492-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/147492-61-0x0000000000416A9E-mapping.dmp

Download
memory/147492-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/147492-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/147492-64-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download