redline | 1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2022 01:34

Target

1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe
Size

214KB
MD5

c1adaf98f8c567048839897999f84f9c
SHA1

241fb4a1f39cc4ea63f135f40795bb2c6f169f23
SHA256

1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a
SHA512

5be1247fd7ca12b99c8f58592c1fabff1f6091f17e79a53a1b0064ed2d032b04cb9e989e4029d91d90204a9b5bd126a7d1981987cccea077f3bce7e8906d5c7e
SSDEEP

3072:aQw78gtyq/HfLTr4Ch/KjL4BpwxrY34YMPvBIrVgkhtztAIQ5AovygF7ocTt/oxa:aQ0/LTrB/KcDMnByVgkLztnaygF8g/r

Score

10^/10

Family

redline

Botnet

@Santey6

baaffanyela.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 4436	3804	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5080	3804	WerFault.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4436	3804	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	83
PID 3804 wrote to memory of 4436	3804	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	83
PID 3804 wrote to memory of 4436	3804	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	83
PID 3804 wrote to memory of 4436	3804	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	83
PID 3804 wrote to memory of 4436	3804	1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe	83

C:\Users\Admin\AppData\Local\Temp\1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe
"C:\Users\Admin\AppData\Local\Temp\1873e78bd7364486ab4b563ca9c58ec76cb75c4acfa48b261d78d85a537c749a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 152
  2⤵
  - Program crash
  PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3804 -ip 3804
1⤵
PID:2400

memory/3804-138-0x00000000006C0000-0x00000000006FC000-memory.dmp

Filesize
240KB

Download
memory/4436-132-0x0000000000000000-mapping.dmp

Download
memory/4436-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4436-139-0x0000000005750000-0x0000000005D68000-memory.dmp

Filesize
6.1MB

Download
memory/4436-140-0x00000000052D0000-0x00000000053DA000-memory.dmp

Filesize
1.0MB

Download
memory/4436-141-0x0000000005200000-0x0000000005212000-memory.dmp

Filesize
72KB

Download
memory/4436-142-0x0000000005260000-0x000000000529C000-memory.dmp

Filesize
240KB

Download