redline | 854868444936c104865264145a8f00147741a523d666fe7e503324ca1adbb4d5

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2023 16:50

Target

tmp.exe
Size

897KB
MD5

2ac0ff27c872b8b784d31027f05d44cd
SHA1

e8fa3f7dfd40bfc23935fc5ea4566c76b69f506b
SHA256

854868444936c104865264145a8f00147741a523d666fe7e503324ca1adbb4d5
SHA512

38436eec9116b77b62c9398d9440149f4d3ce0a5a9606874580390c159fca7b68db2866fdb20474caa86cef3ff1b0eae08b93fa36a2f03d9a37b9266df2d3ac0
SSDEEP

12288:lpMIQ1ZFhNpVxd5lvhZUiCTa1iHbqKpvlMyMtip8+CjLDAHQEOh24s2:lEhWqKsyMPDIQEOs

Score

10^/10

Family

redline

Botnet

Anh123

199.115.193.116:11300

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 4992 set thread context of 4904 4992 tmp.exe tmp.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1616 4904 WerFault.exe tmp.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

tmp.exe

pid process

4904 tmp.exe

description	pid	process	target process
PID 4992 set thread context of 4904	4992	tmp.exe	tmp.exe

pid	pid_target	process	target process
1616	4904	WerFault.exe	tmp.exe

pid	process
4904	tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe
PID 4992 wrote to memory of 4904	4992	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp.exe
2⤵
- Suspicious use of UnmapMainImage
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 12
3⤵
- Program crash
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4904 -ip 4904
1⤵
PID:3920

memory/4904-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4904-140-0x00000000003D0000-0x00000000003D0000-memory.dmp

Download
memory/4992-133-0x00000000004A0000-0x0000000000586000-memory.dmp

Filesize
920KB

Download
memory/4992-134-0x0000000005450000-0x00000000059F4000-memory.dmp

Filesize
5.6MB

Download
memory/4992-135-0x0000000004F80000-0x0000000005012000-memory.dmp

Filesize
584KB

Download
memory/4992-136-0x0000000005F30000-0x000000000645C000-memory.dmp

Filesize
5.2MB

Download
memory/4992-137-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download