redline | 25859ba3aba160a006626908aef75f504e5e6bc04bd7b518bbe35f3ef002b42d

Analysis

max time kernel
147s
max time network
191s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:41

Target

038f62be77cd59199a6ed8fce8686d93.exe
Size

95KB
MD5

038f62be77cd59199a6ed8fce8686d93
SHA1

f9f0748d73b56a0f3423a0cd82ece170e7825ac4
SHA256

25859ba3aba160a006626908aef75f504e5e6bc04bd7b518bbe35f3ef002b42d
SHA512

a1dde768b76c9dc5cd6333e33f1b2a8c2f65fc013f3e16c437df219ef008a6f0dbbe72c442c563c81702620af93c86b20af19e2ec1f4e61c43aa8b23f53889ad
SSDEEP

1536:Bqs0FRcqWClbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2itmulgS6pUl:v0RclyY7+zi0ZbYe1g0ujyzdWU

Score

10^/10

Family

redline

Botnet

main

45.15.157.9:4228

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1004-54-0x0000000000EA0000-0x0000000000EBE000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

038f62be77cd59199a6ed8fce8686d93.exe

description pid process

Token: SeDebugPrivilege 1004 038f62be77cd59199a6ed8fce8686d93.exe

description	pid	process
Token: SeDebugPrivilege	1004	038f62be77cd59199a6ed8fce8686d93.exe

C:\Users\Admin\AppData\Local\Temp\038f62be77cd59199a6ed8fce8686d93.exe
"C:\Users\Admin\AppData\Local\Temp\038f62be77cd59199a6ed8fce8686d93.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004

memory/1004-54-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

Filesize
120KB

Download
memory/1004-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download