redline | 278c453dd51c8bbb92f35be224aba15a5334b7f2451322b9f2c66ae3137f3681

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 16:13

Target

New folder (2)/Setup.exe
Size

289KB
MD5

f34eb45a648c17bd9dcff9ca630b8db0
SHA1

bd6882177c303ae9a4df8ca33fb15a97d3c6fdec
SHA256

f0dc8033ddabb70b2552782a1f5ed3332ca02729293a849cb58a60b473be2454
SHA512

d98240c2eba9ac3318af0a61addd7c00b329098fb1d8298dc4c28d1ef51f0f6d909d9b8234c30de8e64a6fb561c4bd5b804c7842bde3cfc896791a843314defe
SSDEEP

3072:JruhF8XVGbp9pebqabGC6Fy/pCNmZVOh/iUEIQWQoaypfn7XbX+QphgtqgGax:Jqh+QdvabGepwIYQ/Ty1nZSqg

Score

10^/10

Family

redline

45.15.157.131:36457

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 2368	1972	Setup.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	1972	WerFault.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2368	1972	Setup.exe	86
PID 1972 wrote to memory of 2368	1972	Setup.exe	86
PID 1972 wrote to memory of 2368	1972	Setup.exe	86
PID 1972 wrote to memory of 2368	1972	Setup.exe	86
PID 1972 wrote to memory of 2368	1972	Setup.exe	86

C:\Users\Admin\AppData\Local\Temp\New folder (2)\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (2)\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 140
  2⤵
  - Program crash
  PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1972 -ip 1972
1⤵
PID:1664

memory/2368-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2368-138-0x0000000005640000-0x0000000005C58000-memory.dmp

Filesize
6.1MB

Download
memory/2368-139-0x0000000005160000-0x000000000526A000-memory.dmp

Filesize
1.0MB

Download
memory/2368-140-0x00000000050B0000-0x00000000050C2000-memory.dmp

Filesize
72KB

Download
memory/2368-141-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/2368-142-0x00000000050D0000-0x000000000510C000-memory.dmp

Filesize
240KB

Download
memory/2368-143-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download