redline | ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a

Analysis

max time kernel
284s
max time network
296s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 22:17

Target

ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe
Size

292KB
MD5

65a08ffc4bdb323b6899ae9737f747f6
SHA1

6a7fa5c964ab7548ce8492d3374bc346dbf13839
SHA256

ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a
SHA512

ea5443621fdc13634b0503aa830eba4a6c612ce772da25f005e14e9e6671324b1a0b0f026c136ffc1a04e11028646245d6d28b3d171c06416af0d66fba544b40
SSDEEP

6144:JZ5UN3ALaT+qAvDwgCzJ5vIwjs5WIQuqg:JXUN3ALaxAaLjAQ

Score

10^/10

Family

redline

135.181.173.163:4323

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 920	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	29
PID 2000 wrote to memory of 1860	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	30
PID 2000 wrote to memory of 1860	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	30
PID 2000 wrote to memory of 1860	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	30
PID 2000 wrote to memory of 1860	2000	ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe	30

C:\Users\Admin\AppData\Local\Temp\ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe
"C:\Users\Admin\AppData\Local\Temp\ee15e18baf8d9726fab400c01b678c47cd0c02c04f857eec8f58bc4d7daf248a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 36
  2⤵
  - Program crash
  PID:1860

memory/920-54-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/920-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/920-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/920-61-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/920-62-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/920-63-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/920-64-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download