redline | 55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f

Analysis

max time kernel
171s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:49

Target

55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe
Size

558KB
MD5

d907b6b9e3dac031bba4ecc6cedea6dd
SHA1

62ee494ae2a55fee2d3d1a200bec91d50a637a0a
SHA256

55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f
SHA512

135e53b094226b82737087b8be32edf54884cc2bd182139f55b97ba98a8b265343212d05dcfb4deab0c871c49a0827181731e53e0414666a5aed39408ceffc99
SSDEEP

12288:wEcKWGlRSkvoEMonD7N+uyx7Ut5g6bltalwq72W:m2Skv6YDO96JtOwqSW

Score

10^/10

Family

redline

Botnet

16.11

194.62.42.182:9697

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe

description	pid	process	target process
PID 2000 set thread context of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe

description	pid	process	target process
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe
PID 2000 wrote to memory of 2728	2000	55bf7ebfe93e5feff3701c868a2eabd8bb182a288fbc887288bca3f06fac1d9f.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe"
2⤵
PID:2728

memory/2728-133-0x00000000005182DE-mapping.dmp

Download
memory/2728-132-0x0000000000500000-0x0000000000538000-memory.dmp

Filesize
224KB

Download
memory/2728-134-0x0000000005140000-0x0000000005758000-memory.dmp

Filesize
6.1MB

Download
memory/2728-135-0x0000000002560000-0x0000000002572000-memory.dmp

Filesize
72KB

Download
memory/2728-136-0x0000000004C30000-0x0000000004D3A000-memory.dmp

Filesize
1.0MB

Download
memory/2728-137-0x0000000004B20000-0x0000000004B5C000-memory.dmp

Filesize
240KB

Download