redline | a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825

Analysis

max time kernel
249s
max time network
351s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 19:03

Target

a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825.exe
Size

317KB
MD5

ab4f815471396e666d7457c15d2071cb
SHA1

6170fc8ae933254ba5676504ddaf745e923729b1
SHA256

a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825
SHA512

df9716310b6312deca57c206f06b18921082dd8476fc6b29f88bde3583f4422133222ba3e55148e2bef9731057287abc3278e6edf1f32e0ed4f2507094991dda
SSDEEP

6144:UrSLhL3leQViOgaGeaNUeorzhrNuFmkCvLiXZnMOn:UrSlj0QkONoUeo3VNSm7vLqr

Score

10^/10

Family

redline

Botnet

NewYear2023

185.106.92.111:2510

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-54-0x00000000023C0000-0x00000000023FE000-memory.dmp	family_redline
behavioral1/memory/1516-58-0x0000000002400000-0x000000000243C000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825.exe

description pid process

Token: SeDebugPrivilege 1516 a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825.exe

description	pid	process
Token: SeDebugPrivilege	1516	a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825.exe

C:\Users\Admin\AppData\Local\Temp\a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825.exe
"C:\Users\Admin\AppData\Local\Temp\a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

memory/1516-54-0x00000000023C0000-0x00000000023FE000-memory.dmp

Filesize
248KB

Download
memory/1516-56-0x0000000000220000-0x000000000025E000-memory.dmp

Filesize
248KB

Download
memory/1516-57-0x0000000000400000-0x000000000066D000-memory.dmp

Filesize
2.4MB

Download
memory/1516-55-0x000000000077B000-0x00000000007AC000-memory.dmp

Filesize
196KB

Download
memory/1516-58-0x0000000002400000-0x000000000243C000-memory.dmp

Filesize
240KB

Download
memory/1516-59-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/1516-60-0x000000000077B000-0x00000000007AC000-memory.dmp

Filesize
196KB

Download