redline | 2da73bff9624b981e8bedce6cb13d4593eaf758f70bd2ece15dde5ffc6fda065

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-03-2023 22:56

Target

FortHack.exe
Size

2.5MB
MD5

c4d460b4f7da75c7db76347d8de50093
SHA1

d9e250bee98b5d46e6929c6df3c129aa94ca2a40
SHA256

2da73bff9624b981e8bedce6cb13d4593eaf758f70bd2ece15dde5ffc6fda065
SHA512

9fc9fe17ffb5631fd01328bfe9f02f897808cda30969616d279346b2b69c3982858bd36657c5c2b725c934e1350118ca55026c91937e8ee7b540482ca1992333
SSDEEP

24576:2AaodXP6bRPbWYhYOxlwvBVMT+dLEEuoi/GPCOPv1cmd5LZRiI1l3RuQ55313A:28dfiRPe9ShOH1cmd5aI1l3i

Score

10^/10

Family

redline

Botnet

@quppie2000

193.233.193.15:27469

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/188292-55-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1868-62-0x0000000000400000-0x0000000000573000-memory.dmp	family_redline
behavioral1/memory/188292-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/188292-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 188292	1868	FortHack.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28
PID 1868 wrote to memory of 188292	1868	FortHack.exe	28

C:\Users\Admin\AppData\Local\Temp\FortHack.exe
"C:\Users\Admin\AppData\Local\Temp\FortHack.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:188292

memory/1868-62-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download
memory/188292-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/188292-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/188292-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/188292-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/188292-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/188292-64-0x0000000000CB0000-0x0000000000CF0000-memory.dmp

Filesize
256KB

Download
memory/188292-65-0x0000000000CB0000-0x0000000000CF0000-memory.dmp

Filesize
256KB

Download