redline | dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165

Analysis

max time kernel
56s
max time network
182s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
24-03-2023 22:17

Target

dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
Size

895KB
MD5

3c62500496bfc4f35d38ddbe71be78c2
SHA1

4982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256

dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512

d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
SSDEEP

12288:YGKSH3TvrnDfbXzhL/gWmmfsMsNWUZV8le27t7mZOljg5fAQTQWtGCgd1ScnQMy://kGCg2+QG9Sts

Score

10^/10

Family

redline

Botnet

Cong

199.115.193.171:48258

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe

description	pid	process	target process
PID 4604 set thread context of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3936 2756 WerFault.exe dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe

pid	pid_target	process	target process
3936	2756	WerFault.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe

description	pid	process	target process
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
PID 4604 wrote to memory of 2756	4604	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe	dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe

C:\Users\Admin\AppData\Local\Temp\dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
C:\Users\Admin\AppData\Local\Temp\dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165.exe
2⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 24
3⤵
- Program crash
PID:3936

memory/2756-125-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2756-128-0x0000000000350000-0x0000000000350000-memory.dmp

Download
memory/4604-119-0x0000000000D40000-0x0000000000E26000-memory.dmp

Filesize
920KB

Download
memory/4604-120-0x0000000005B00000-0x0000000005FFE000-memory.dmp

Filesize
5.0MB

Download
memory/4604-121-0x00000000056A0000-0x0000000005732000-memory.dmp

Filesize
584KB

Download
memory/4604-122-0x0000000005740000-0x0000000005A90000-memory.dmp

Filesize
3.3MB

Download
memory/4604-123-0x0000000006530000-0x0000000006A5C000-memory.dmp

Filesize
5.2MB

Download
memory/4604-124-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download