redline | 278c453dd51c8bbb92f35be224aba15a5334b7f2451322b9f2c66ae3137f3681

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 16:13

Target

New folder (2)/Setup.exe
Size

289KB
MD5

f34eb45a648c17bd9dcff9ca630b8db0
SHA1

bd6882177c303ae9a4df8ca33fb15a97d3c6fdec
SHA256

f0dc8033ddabb70b2552782a1f5ed3332ca02729293a849cb58a60b473be2454
SHA512

d98240c2eba9ac3318af0a61addd7c00b329098fb1d8298dc4c28d1ef51f0f6d909d9b8234c30de8e64a6fb561c4bd5b804c7842bde3cfc896791a843314defe
SSDEEP

3072:JruhF8XVGbp9pebqabGC6Fy/pCNmZVOh/iUEIQWQoaypfn7XbX+QphgtqgGax:Jqh+QdvabGepwIYQ/Ty1nZSqg

Score

10^/10

Family

redline

45.15.157.131:36457

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 1996	2000	Setup.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1156	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1996	2000	Setup.exe	29
PID 2000 wrote to memory of 1156	2000	Setup.exe	30
PID 2000 wrote to memory of 1156	2000	Setup.exe	30
PID 2000 wrote to memory of 1156	2000	Setup.exe	30
PID 2000 wrote to memory of 1156	2000	Setup.exe	30
PID 2000 wrote to memory of 1156	2000	Setup.exe	30
PID 2000 wrote to memory of 1156	2000	Setup.exe	30
PID 2000 wrote to memory of 1156	2000	Setup.exe	30

C:\Users\Admin\AppData\Local\Temp\New folder (2)\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (2)\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 36
  2⤵
  - Program crash
  PID:1156

memory/1996-55-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/1996-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1996-54-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/1996-61-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/1996-62-0x0000000000090000-0x00000000000C0000-memory.dmp

Filesize
192KB

Download
memory/1996-63-0x0000000005100000-0x0000000005140000-memory.dmp

Filesize
256KB

Download
memory/1996-64-0x0000000005100000-0x0000000005140000-memory.dmp

Filesize
256KB

Download