redline | 2b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43

Analysis

max time kernel
159s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2023 00:50

Target

arnatic_7.exe
Size

378KB
MD5

5632c0cda7da1c5b57aeffeead5c40b7
SHA1

533805ba88fbd008457616ae2c3b585c952d3afe
SHA256

2b4a3c6d5d62270440c34e1ea75ba2878523eccc4ef85692c0e9497b6f1a8f43
SHA512

e86a2c0eb84b41bae94a1d29cc26c069d7ba0da8ed06f26192bd4e601b1c0168b2396734e17f585da531976125178f9a230ef7071cbd616cb070c44bcc16b990
SSDEEP

3072:+L5+5Yqofb/UXdX+EioqPE056SMt2dlwMdjLubX96Tzj3ygfu6noqZV0pq8eGWRK:p5Yqofb/kbrQ6S+cDZLubN6TTVwfk6I

Score

10^/10

Family

redline

Botnet

DomAni2

flestriche.xyz:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3468-133-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/3468-134-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

arnatic_7.exe

description pid process target process

PID 5048 set thread context of 3468 5048 arnatic_7.exe arnatic_7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

arnatic_7.exe

description pid process

Token: SeDebugPrivilege 3468 arnatic_7.exe

description	pid	process	target process
PID 5048 set thread context of 3468	5048	arnatic_7.exe	arnatic_7.exe

description	pid	process
Token: SeDebugPrivilege	3468	arnatic_7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

arnatic_7.exe

description	pid	process	target process
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe
PID 5048 wrote to memory of 3468	5048	arnatic_7.exe	arnatic_7.exe

C:\Users\Admin\AppData\Local\Temp\arnatic_7.exe
C:\Users\Admin\AppData\Local\Temp\arnatic_7.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468

memory/3468-133-0x0000000000000000-mapping.dmp

Download
memory/3468-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3468-135-0x0000000005510000-0x0000000005B28000-memory.dmp

Filesize
6.1MB

Download
memory/3468-136-0x0000000004F80000-0x0000000004F92000-memory.dmp

Filesize
72KB

Download
memory/3468-137-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/3468-138-0x0000000005290000-0x000000000539A000-memory.dmp

Filesize
1.0MB

Download
memory/5048-132-0x00000000003A0000-0x0000000000404000-memory.dmp

Filesize
400KB

Download