redline | fdf21b2027c9f19edbb1c04427966454c1844f1219b80aac0e7934889a50fc6d

Analysis

max time kernel
136s
max time network
189s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 21:38

Target

3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b.exe
Size

276KB
MD5

22fb3ebdc6e9ba1428324da1473aad3c
SHA1

09aba11aa42e08a9222a93eb956e5a6a655ec383
SHA256

3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b
SHA512

c29059eb1131ba044eef5d71c8987718427598f3741113a6528272fdb64ff96754c26b7795991cf0cdf0b5d02225fc07691e53a561457eda1f47d876bae5e72c
SSDEEP

6144:m1ckWFS7HIdemvtS9wlraIjVsHtE8cxyNQV4wo3:mIFSMEmvtQwQ3t6Zuw2

Score

10^/10

Family

redline

Botnet

NewYear2023

185.106.92.111:2510

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-56-0x0000000002670000-0x00000000026AE000-memory.dmp	family_redline
behavioral1/memory/1900-57-0x00000000026B0000-0x00000000026EC000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b.exe

description pid process

Token: SeDebugPrivilege 1900 3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b.exe

description	pid	process
Token: SeDebugPrivilege	1900	3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b.exe

C:\Users\Admin\AppData\Local\Temp\3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b.exe
"C:\Users\Admin\AppData\Local\Temp\3428c8840f6dbf06ae69004390c4d744b2efebc3e17bbcd85dbd19306c9f045b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900

memory/1900-54-0x0000000000BFB000-0x0000000000C2C000-memory.dmp

Filesize
196KB

Download
memory/1900-55-0x0000000000220000-0x000000000025E000-memory.dmp

Filesize
248KB

Download
memory/1900-56-0x0000000002670000-0x00000000026AE000-memory.dmp

Filesize
248KB

Download
memory/1900-57-0x00000000026B0000-0x00000000026EC000-memory.dmp

Filesize
240KB

Download
memory/1900-58-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1900-59-0x0000000000400000-0x0000000000AF7000-memory.dmp

Filesize
7.0MB

Download
memory/1900-61-0x0000000000220000-0x000000000025E000-memory.dmp

Filesize
248KB

Download
memory/1900-60-0x0000000000BFB000-0x0000000000C2C000-memory.dmp

Filesize
196KB

Download