redline | ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c

General

Target

ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
Size

1004KB
MD5

36a142814138d3833fabda1749571fd8
SHA1

3d6192913d673da7a79ef9927d76e981cf8a8fd9
SHA256

ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c
SHA512

5cc5396952ec1e668a193f1d5be8d7e49331202d229a69e7634eca0f7eac5e36f281e8f7918d9e354009b0f985c5a570ec989ae9d336090c72d9750176e432e6
SSDEEP

12288:D5QEFuBP+MapWUIghSp3zgdXm0Ys5AkacCWkQ+vFajOJiVwEb4SFW5NnvQqBzV:DyEsQ95F1Rz5OmwEU6W5JQqB

Score

10^/10

redline 11 infostealer

Malware Config

Extracted

Family

redline

Botnet

11

C2

95.181.172.238:3214

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/524-61-0x0000000000400000-0x000000000042A000-memory.dmp	family_redline
behavioral1/memory/524-64-0x0000000000421FBE-mapping.dmp	family_redline
behavioral1/memory/524-63-0x0000000000400000-0x000000000042A000-memory.dmp	family_redline
behavioral1/memory/524-62-0x0000000000400000-0x000000000042A000-memory.dmp	family_redline
behavioral1/memory/524-66-0x0000000000400000-0x000000000042A000-memory.dmp	family_redline
behavioral1/memory/524-68-0x0000000000400000-0x000000000042A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

description	pid	process	target process
PID 1324 set thread context of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

description pid process

Token: SeDebugPrivilege 524 ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

description	pid	process
Token: SeDebugPrivilege	524	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

description	pid	process	target process
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
PID 1324 wrote to memory of 524	1324	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe	ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe

C:\Users\Admin\AppData\Local\Temp\ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
"C:\Users\Admin\AppData\Local\Temp\ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\ad58cdddaa732147848d3c5dc0e6ba560bb573f8d5430ce48fda1cabaed7300c.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-58-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-59-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-61-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-64-0x0000000000421FBE-mapping.dmp

Download
memory/524-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-62-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-66-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/524-68-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1324-54-0x0000000000FC0000-0x00000000010C2000-memory.dmp

Filesize
1.0MB

Download
memory/1324-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1324-56-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/1324-57-0x0000000005A80000-0x0000000005B04000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads