redline | b9295973fe5e570513c08e933e0ab2b45723757e14749bda60dbd328f74d79aa

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/03/2023, 09:18

Target

ZoomInstaller_patched.exe
Size

7.2MB
MD5

acafac05b1ee32e5a6b07286ecb7da18
SHA1

d1c6fb44ed5c1e9fb2937427174f0129e9206f9a
SHA256

b9295973fe5e570513c08e933e0ab2b45723757e14749bda60dbd328f74d79aa
SHA512

7d3a5a24a8d4ae08f01a2b6a0589687e17e4a315a2db9929e5b643c65f0c9043543bcfbacb38d48638a623b77498844ec8d5fae602f1e367cd07a84c30bf0de1
SSDEEP

196608:C4tBfK3tY8agodu/cHsjGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG:C4tIY8agsu/cMjGGGGGGGGGGGGGGGGGu

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
624	ZoomInstaller_patched.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	ZoomInstaller_patched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1220	624	ZoomInstaller_patched.exe	28
PID 624 wrote to memory of 1220	624	ZoomInstaller_patched.exe	28
PID 624 wrote to memory of 1220	624	ZoomInstaller_patched.exe	28
PID 624 wrote to memory of 1220	624	ZoomInstaller_patched.exe	28

C:\Users\Admin\AppData\Local\Temp\ZoomInstaller_patched.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstaller_patched.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe"
  2⤵
  PID:1220

memory/624-54-0x0000000000A10000-0x0000000001154000-memory.dmp

Filesize
7.3MB

Download
memory/624-55-0x000000001B8E0000-0x000000001B960000-memory.dmp

Filesize
512KB

Download
memory/624-56-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/624-57-0x000000001BAB0000-0x000000001BD30000-memory.dmp

Filesize
2.5MB

Download