redline | 1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/12/2022, 01:34

Target

1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe
Size

214KB
MD5

c1adaf98f8c567048839897999f84f9c
SHA1

241fb4a1f39cc4ea63f135f40795bb2c6f169f23
SHA256

1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a
SHA512

5be1247fd7ca12b99c8f58592c1fabff1f6091f17e79a53a1b0064ed2d032b04cb9e989e4029d91d90204a9b5bd126a7d1981987cccea077f3bce7e8906d5c7e
SSDEEP

3072:aQw78gtyq/HfLTr4Ch/KjL4BpwxrY34YMPvBIrVgkhtztAIQ5AovygF7ocTt/oxa:aQ0/LTrB/KcDMnByVgkLztnaygF8g/r

Score

10^/10

Family

redline

Botnet

@Santey6

baaffanyela.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 832 set thread context of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	832	WerFault.exe	26

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 1788	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	28
PID 832 wrote to memory of 972	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	29
PID 832 wrote to memory of 972	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	29
PID 832 wrote to memory of 972	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	29
PID 832 wrote to memory of 972	832	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	29

C:\Users\Admin\AppData\Local\Temp\1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe
"C:\Users\Admin\AppData\Local\Temp\1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 52
  2⤵
  - Program crash
  PID:972

memory/832-66-0x0000000000F30000-0x0000000000F6C000-memory.dmp

Filesize
240KB

Download
memory/1788-54-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1788-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1788-62-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1788-63-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1788-64-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download