redline | bc83cf38e8a0254094978aa996c128cb2d95bac9370b9dbe6c3112a10023df26

Analysis

max time kernel
87s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2023, 01:28

Target
setup.exe
Size 1.1MB
Sample230423-bvvmdsaa59
SHA256 bc83cf38e8a0254094978aa996c128cb2d95bac9370b9dbe6c3112a10023df26
MD5 89ff3329bfa461d4c5f6a43c7fee38f2
SHA1 ca9cb41fbff8806bee7f7c5bce5cac274c1eae8a
SHA512 78521b232776e36687026ad8122aa31f1906aa5e0dc9b7f751b56e06095a50db352fb46aaf9574b1eb8c4ab21d0c2315945308ccf575b13b6a57c799e342ef32
SSDEEP 6144:z8IXHaRijlgDAObnpLPYIxtYxNr7ZyfuoUaY:z8IXHBqffxtYxNnZyW7aY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 2072	1052	setup.exe	87

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3400	1052	WerFault.exe	85
2680	2072	WerFault.exe	87

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2072	1052	setup.exe	87
PID 1052 wrote to memory of 2072	1052	setup.exe	87
PID 1052 wrote to memory of 2072	1052	setup.exe	87
PID 1052 wrote to memory of 2072	1052	setup.exe	87
PID 1052 wrote to memory of 2072	1052	setup.exe	87

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 728
    3⤵
    - Program crash
    PID:2680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 148
  2⤵
  - Program crash
  PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1052 -ip 1052
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2072 -ip 2072
1⤵
PID:2152

memory/2072-133-0x0000000000400000-0x000000000042E000-memory.dmp

Download