redline | 7f80912d52e1ecf2f90cf835fac4e6799aea697fba7969775f8e6e263263f41c | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-05-2023 01:55

Sharing

Report Analysis Logs

General

Target

dcc71fdacb65262d4a707bc1aaba72bb.exe
Size

145KB
MD5

dcc71fdacb65262d4a707bc1aaba72bb
SHA1

0f3b4c5203f43319442c096d8c3c6ea2de826e92
SHA256

7f80912d52e1ecf2f90cf835fac4e6799aea697fba7969775f8e6e263263f41c
SHA512

9b9bb87c056a38240395e0e9c212afa02b154a8f1c1b99721b3afe4ecae79f127d5344f4d062f7ea379574a56b45ecf153087d91e429025caedc60b699e036d9
SSDEEP

3072:yV+m5cZQmRSJyq2G7z+Ued26U+QEThhZ98e8h4:yjcWnC1PCEThhH

Score

10^/10

redline luka infostealer

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes

auth_value
44560bcd37d6bf076da309730fdb519a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1764 2040 WerFault.exe dcc71fdacb65262d4a707bc1aaba72bb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dcc71fdacb65262d4a707bc1aaba72bb.exe

description	pid	process	target process
PID 2040 wrote to memory of 1764	2040	dcc71fdacb65262d4a707bc1aaba72bb.exe	WerFault.exe
PID 2040 wrote to memory of 1764	2040	dcc71fdacb65262d4a707bc1aaba72bb.exe	WerFault.exe
PID 2040 wrote to memory of 1764	2040	dcc71fdacb65262d4a707bc1aaba72bb.exe	WerFault.exe
PID 2040 wrote to memory of 1764	2040	dcc71fdacb65262d4a707bc1aaba72bb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dcc71fdacb65262d4a707bc1aaba72bb.exe
"C:\Users\Admin\AppData\Local\Temp\dcc71fdacb65262d4a707bc1aaba72bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 504
2⤵
- Program crash
PID:1764

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x00000000003B0000-0x00000000003DA000-memory.dmp

Filesize
168KB

Download