redline | b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178

Analysis

max time kernel
343s
max time network
350s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 22:17

Target

b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178.exe
Size

280KB
MD5

46cc2c8bf0580105ab7b03218b8073e6
SHA1

4664152a22c1e32b6a3fcaa4c701d164e8f885c8
SHA256

b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178
SHA512

4cc6405462976d83307ef432902092ca0c24f88008555f9333c3def95e6267003df53781c1f88e011a90e40a22ea75e281f4954ae4e81b698934e86e21dea3f3
SSDEEP

3072:MrtdXwqbtlDW7HOFOyW5dP+ZHVaD9sOrLVthGVkjd13Po8URjVU3p2z9Dq3t0Mgq:A5uiFObOHVaiATOEPo8gaEz9+VNbyu5

Score

10^/10

Family

redline

Botnet

NewYear2023

185.106.92.111:2510

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/468-55-0x00000000020D0000-0x000000000210E000-memory.dmp	family_redline
behavioral1/memory/468-57-0x00000000046E0000-0x000000000471C000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178.exe

description pid process

Token: SeDebugPrivilege 468 b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178.exe

description	pid	process
Token: SeDebugPrivilege	468	b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178.exe

C:\Users\Admin\AppData\Local\Temp\b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178.exe
"C:\Users\Admin\AppData\Local\Temp\b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:468

memory/468-55-0x00000000020D0000-0x000000000210E000-memory.dmp

Filesize
248KB

Download
memory/468-56-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/468-58-0x00000000003A0000-0x00000000003DE000-memory.dmp

Filesize
248KB

Download
memory/468-59-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/468-57-0x00000000046E0000-0x000000000471C000-memory.dmp

Filesize
240KB

Download
memory/468-60-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/468-61-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download