redline | ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1

General

Target

ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
Size

1.4MB
MD5

48590ce8e33801f64a586119f2815d96
SHA1

0eb96a0469f3bacd6996af607544ecf014c978de
SHA256

ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1
SHA512

8ef667caae5d0e289b38c52daee5f84f7b06339b532cc4121bcb01e3a883704269946b2323dc82e60eaaca0a17128ef50d834a8191cb340a40e6435f4b7fcfe9
SSDEEP

24576:FYBb6nIWpwir8ESqL39zBcpwIryUkUHAHHHgX63Gg+U9UJpoIgYYFz70vCfGT5qt:XIWpv803newuyUkUHAHHHgX63Gg+U9Ua

Score

10^/10

redline 8allsup infostealer

Malware Config

Extracted

Family

redline

Botnet

8allsup

C2

jbeaef.ga:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2024-63-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/2024-64-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/2024-65-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/2024-66-0x000000000041653E-mapping.dmp	family_redline
behavioral1/memory/2024-68-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/2024-70-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe

description	pid	process	target process
PID 960 set thread context of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exeac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe

description	pid	process
Token: SeDebugPrivilege	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
Token: SeDebugPrivilege	2024	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe

description	pid	process	target process
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
PID 960 wrote to memory of 2024	960	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe	ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe

C:\Users\Admin\AppData\Local\Temp\ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
"C:\Users\Admin\AppData\Local\Temp\ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\ac1ee8dc45b81c53d8ef7f27243eb571986d2797e58d0444962d839c382e7ee1.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x00000000011D0000-0x000000000133C000-memory.dmp

Filesize
1.4MB

Download
memory/960-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/960-56-0x0000000004FF0000-0x000000000509A000-memory.dmp

Filesize
680KB

Download
memory/960-57-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/960-58-0x00000000080A0000-0x000000000812E000-memory.dmp

Filesize
568KB

Download
memory/960-59-0x0000000000690000-0x00000000006D0000-memory.dmp

Filesize
256KB

Download
memory/2024-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-65-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-66-0x000000000041653E-mapping.dmp

Download
memory/2024-68-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2024-70-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads