redline | 86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe
Size

1.2MB
MD5

e68f841675e386eede2a185491f3f62c
SHA1

9d4a1c5c1998ee096cdbfc02804e29265fe66a48
SHA256

86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e
SHA512

3d15df969918d10d9db06a1f958922f71d67f698f39670b13b7b6d44a51a77c7c01fdbadb4033b78a9d0a6f47a19a1bdb8933b2627bc9488071632cf83aebfa4
SSDEEP

6144:mG1dDszSc/wXmkAOoPN1dgj1Gmr1SnpGu014Ohrxdm:n1dDsqiPNDgj13SnM513hrDm

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

135.181.241.192:4327

Attributes

auth_value
a909e2aaecf96137978fea4f86400b9b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1176	2004	WerFault.exe	26
596	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 2028	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	27
PID 2004 wrote to memory of 1176	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	28
PID 2004 wrote to memory of 1176	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	28
PID 2004 wrote to memory of 1176	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	28
PID 2004 wrote to memory of 1176	2004	86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe	28
PID 2028 wrote to memory of 596	2028	RegSvcs.exe	29
PID 2028 wrote to memory of 596	2028	RegSvcs.exe	29
PID 2028 wrote to memory of 596	2028	RegSvcs.exe	29
PID 2028 wrote to memory of 596	2028	RegSvcs.exe	29

C:\Users\Admin\AppData\Local\Temp\86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe
"C:\Users\Admin\AppData\Local\Temp\86f597b3ce3f625eecba774b8ee67dc534b9adeb4472393357d61319274e1f9e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 500
    3⤵
    - Program crash
    PID:596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 72
  2⤵
  - Program crash
  PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2028-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads