redline | 41b88d86f1edce5ff233e6517a49486bd4fa572edf6561ef187c765916c1c3af

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2023, 06:04

Target

ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe
Size

787KB
MD5

e7f3c79a7ccdbb0d41bddedcba03af91
SHA1

fc6f3f5921f4608bd394a6e3eb1a6dc1cec53209
SHA256

ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1
SHA512

e84c0ff61a3a104378e0a34ed78b0cf7561c8a39889928649251332e9b6b0803469d53a0dc8ac6d5216c518ebe3cece0bd0d378791756e3978cd9fc5ffa7f969
SSDEEP

24576:b1tRxsHztPruUBL4dtl/UhebsgaReNHTvaTC3c:RxqNtLIfEebNHbaus

Score

10^/10

Family

redline

37.220.87.13:48790

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3684 set thread context of 3744	3684	ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe	86

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3744	3684	ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe	86
PID 3684 wrote to memory of 3744	3684	ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe	86
PID 3684 wrote to memory of 3744	3684	ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe	86
PID 3684 wrote to memory of 3744	3684	ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe	86
PID 3684 wrote to memory of 3744	3684	ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe	86

C:\Users\Admin\AppData\Local\Temp\ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe
"C:\Users\Admin\AppData\Local\Temp\ab91e4803417bc6c3414ce4ac7f80f181d742d79e8756d64ca4833bef0ac9ff1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3744

memory/3744-134-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3744-139-0x0000000005AC0000-0x00000000060D8000-memory.dmp

Filesize
6.1MB

Download
memory/3744-140-0x0000000005560000-0x0000000005572000-memory.dmp

Filesize
72KB

Download
memory/3744-141-0x0000000005690000-0x000000000579A000-memory.dmp

Filesize
1.0MB

Download
memory/3744-142-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/3744-143-0x00000000055C0000-0x00000000055FC000-memory.dmp

Filesize
240KB

Download
memory/3744-144-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download