redline | 4b6b0a34ad73552d204aaeef9cbd0fb6dfef1029e6edec1a1788de872f4a306b

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14-12-2022 01:55

Target

Ordurous.exe
Size

537KB
MD5

caf008515453f4d6a222c966356831eb
SHA1

0496a3587fc272e8b7ebecd91aac4a10800be5c0
SHA256

4b6b0a34ad73552d204aaeef9cbd0fb6dfef1029e6edec1a1788de872f4a306b
SHA512

34ab48b4799d05b757a7620f15a4124edd8fe1820ba5da410d6fdded021346cb5e26dace3c760b8635071221ee8ff5d25db896f1c14e77b38233f8200afc9ae9
SSDEEP

12288:ejxd4go0QkA+RJZOUA24F3CUaHgn/n3b5Y/pRESOToA:ezwkAuLrTUR/tY/pOSOTo

Score

10^/10

Family

redline

Botnet

94.158.244.106:42091

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ordurous.exe

description pid process target process

PID 1324 set thread context of 328 1324 Ordurous.exe Ordurous.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1088 328 WerFault.exe Ordurous.exe

description	pid	process	target process
PID 1324 set thread context of 328	1324	Ordurous.exe	Ordurous.exe

pid	pid_target	process	target process
1088	328	WerFault.exe	Ordurous.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Ordurous.exeOrdurous.exe

description	pid	process	target process
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 1324 wrote to memory of 328	1324	Ordurous.exe	Ordurous.exe
PID 328 wrote to memory of 1088	328	Ordurous.exe	WerFault.exe
PID 328 wrote to memory of 1088	328	Ordurous.exe	WerFault.exe
PID 328 wrote to memory of 1088	328	Ordurous.exe	WerFault.exe
PID 328 wrote to memory of 1088	328	Ordurous.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Ordurous.exe
C:\Users\Admin\AppData\Local\Temp\Ordurous.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 504
3⤵
- Program crash
PID:1088

memory/328-65-0x00000000004182BE-mapping.dmp

Download
memory/328-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/328-59-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/328-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/328-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/328-64-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/328-67-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/328-69-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1088-70-0x0000000000000000-mapping.dmp

Download
memory/1324-55-0x0000000006F70000-0x00000000070BA000-memory.dmp

Filesize
1.3MB

Download
memory/1324-56-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1324-57-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1324-54-0x0000000000DC0000-0x0000000000E4C000-memory.dmp

Filesize
560KB

Download