redline | 2b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43

Analysis

max time kernel
12s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-01-2023 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

arnatic_7.exe
Size

378KB
MD5

5632c0cda7da1c5b57aeffeead5c40b7
SHA1

533805ba88fbd008457616ae2c3b585c952d3afe
SHA256

2b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43
SHA512

e86a2c0eb84b41bae94a1d29cc26c069d7ba0da8ed06f26192bd4e601b1c0168b2396734e17f585da531976125178f9a230ef7071cbd616cb070c44bcc16b990
SSDEEP

3072:+L5+5Yqofb/UXdX+EioqPE056SMt2dlwMdjLubX96Tzj3ygfu6noqZV0pq8eGWRK:p5Yqofb/kbrQ6S+cDZLubN6TTVwfk6I

Score

10^/10

redline domani2 infostealer

Malware Config

Extracted

Family

redline

Botnet

DomAni2

flestriche.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1236-59-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1236-58-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1236-60-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1236-61-0x0000000000417E3A-mapping.dmp	family_redline
behavioral1/memory/1236-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1236-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

arnatic_7.exe

description pid process target process

PID 1968 set thread context of 1236 1968 arnatic_7.exe arnatic_7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

arnatic_7.exe

description pid process

Token: SeDebugPrivilege 1236 arnatic_7.exe

description	pid	process	target process
PID 1968 set thread context of 1236	1968	arnatic_7.exe	arnatic_7.exe

description	pid	process
Token: SeDebugPrivilege	1236	arnatic_7.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

arnatic_7.exe

description	pid	process	target process
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe
PID 1968 wrote to memory of 1236	1968	arnatic_7.exe	arnatic_7.exe

C:\Users\Admin\AppData\Local\Temp\arnatic_7.exe
"C:\Users\Admin\AppData\Local\Temp\arnatic_7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\arnatic_7.exe
C:\Users\Admin\AppData\Local\Temp\arnatic_7.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-59-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-61-0x0000000000417E3A-mapping.dmp

Download
memory/1236-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-66-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1968-54-0x0000000001170000-0x00000000011D4000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads