redline | 56d8611936d8264b3fab9451f57ed8ef5bfcab43a2a1d14c6faf5556bedbccf1

Analysis

max time kernel
121s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 13:16

Target

file.exe
Size

372KB
MD5

6e1c8047cd8888ad27dd34d430cf1485
SHA1

8d56c99a6ca73e88e6e68e90ba9435a622451726
SHA256

56d8611936d8264b3fab9451f57ed8ef5bfcab43a2a1d14c6faf5556bedbccf1
SHA512

f97b63b97fbc0a0e80538102e79a534924df44ad4cb001b1a5be92fd0addcdcf4512e4b2705e3d57a4d652a7db7cdec0fc448282be6134c607f1b72600edb44d
SSDEEP

3072:J/YVvMvV9YX80mAOMQLFyXQPkuOev5fjCYNDHUk0MSCM2qGW4W3Itqggax:J/i0NslOWevxjBD0o/bqhkqg

Score

10^/10

Family

redline

Botnet

2703-doZKey

137.184.30.252:81

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 2868	4028	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	4028	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2868	AppLaunch.exe
2868	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2868	4028	file.exe	86
PID 4028 wrote to memory of 2868	4028	file.exe	86
PID 4028 wrote to memory of 2868	4028	file.exe	86
PID 4028 wrote to memory of 2868	4028	file.exe	86
PID 4028 wrote to memory of 2868	4028	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 136
  2⤵
  - Program crash
  PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4028 -ip 4028
1⤵
PID:4652

memory/2868-133-0x0000000000600000-0x0000000000646000-memory.dmp

Filesize
280KB

Download
memory/2868-138-0x00000000051B0000-0x00000000057C8000-memory.dmp

Filesize
6.1MB

Download
memory/2868-139-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

Filesize
72KB

Download
memory/2868-140-0x0000000004D00000-0x0000000004E0A000-memory.dmp

Filesize
1.0MB

Download
memory/2868-141-0x0000000004C30000-0x0000000004C6C000-memory.dmp

Filesize
240KB

Download
memory/2868-142-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2868-143-0x0000000004FC0000-0x0000000005026000-memory.dmp

Filesize
408KB

Download
memory/2868-144-0x0000000006680000-0x0000000006C24000-memory.dmp

Filesize
5.6MB

Download
memory/2868-145-0x00000000061E0000-0x0000000006272000-memory.dmp

Filesize
584KB

Download
memory/2868-146-0x00000000064F0000-0x0000000006540000-memory.dmp

Filesize
320KB

Download
memory/2868-147-0x00000000065C0000-0x0000000006636000-memory.dmp

Filesize
472KB

Download
memory/2868-148-0x0000000006F00000-0x00000000070C2000-memory.dmp

Filesize
1.8MB

Download
memory/2868-149-0x0000000007C10000-0x000000000813C000-memory.dmp

Filesize
5.2MB

Download
memory/2868-150-0x0000000006E00000-0x0000000006E1E000-memory.dmp

Filesize
120KB

Download
memory/2868-151-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download