redline | 119e98871567c82fd70bf47caa657ae9865f15e369ac2c381be23f3a2c8418c4

Analysis

max time kernel
13s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
21/03/2023, 17:23

Target

Run.exe
Size

258KB
MD5

2f197fca331cfb3b9975b0060c79f535
SHA1

a9ab2a146053729fcda6f27c1fbc44301ee3de2a
SHA256

119e98871567c82fd70bf47caa657ae9865f15e369ac2c381be23f3a2c8418c4
SHA512

af13007c41605eb424e3e1cd47017564d244148ce26b192eed04cc64564cbc64cb71aa6e96b37d2d6685fad6a6e15603cf7fb68776ac1d3b9485ca802f212f86
SSDEEP

6144:hh2jMQvMuIIkQ/LsqVtjdTJVdRAuU07CP:HzHuIIwmFrRUeG

Score

10^/10

Family

redline

45.15.157.131:36457

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 1536	4984	Run.exe	86

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 1536	4984	Run.exe	86
PID 4984 wrote to memory of 1536	4984	Run.exe	86
PID 4984 wrote to memory of 1536	4984	Run.exe	86
PID 4984 wrote to memory of 1536	4984	Run.exe	86
PID 4984 wrote to memory of 1536	4984	Run.exe	86

C:\Users\Admin\AppData\Local\Temp\Run.exe
"C:\Users\Admin\AppData\Local\Temp\Run.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:1536

memory/1536-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1536-138-0x0000000005BA0000-0x00000000061B8000-memory.dmp

Filesize
6.1MB

Download
memory/1536-139-0x0000000005720000-0x000000000582A000-memory.dmp

Filesize
1.0MB

Download
memory/1536-140-0x0000000005650000-0x0000000005662000-memory.dmp

Filesize
72KB

Download
memory/1536-141-0x00000000056B0000-0x00000000056EC000-memory.dmp

Filesize
240KB

Download
memory/1536-142-0x0000000005940000-0x0000000005950000-memory.dmp

Filesize
64KB

Download
memory/1536-143-0x0000000006400000-0x0000000006420000-memory.dmp

Filesize
128KB

Download
memory/1536-144-0x0000000006570000-0x0000000006672000-memory.dmp

Filesize
1.0MB

Download
memory/1536-145-0x0000000006680000-0x0000000006712000-memory.dmp

Filesize
584KB

Download
memory/1536-146-0x0000000006CD0000-0x0000000007274000-memory.dmp

Filesize
5.6MB

Download
memory/1536-147-0x0000000006720000-0x0000000006786000-memory.dmp

Filesize
408KB

Download
memory/1536-148-0x0000000007D30000-0x0000000007EF2000-memory.dmp

Filesize
1.8MB

Download
memory/1536-149-0x0000000008430000-0x000000000895C000-memory.dmp

Filesize
5.2MB

Download