redline | f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd

Analysis

max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2023 11:14

Target

config.dll.exe
Size

12KB
MD5

03c3f979feffbf02e7ab9a66f9a1f7b4
SHA1

826e5038b32c3975821eb8641e484b575fdfa7e9
SHA256

f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd
SHA512

14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea
SSDEEP

192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6

Score

10^/10

Family

redline

Botnet

Love Fi Lo

111.90.149.195:55186

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1100-137-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1100-137-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

config.dll.exe

description pid process target process

PID 4460 set thread context of 1100 4460 config.dll.exe aspnet_regbrowsers.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

config.dll.exeaspnet_regbrowsers.exe

description pid process

Token: SeDebugPrivilege 4460 config.dll.exe
Token: SeDebugPrivilege 1100 aspnet_regbrowsers.exe

description	pid	process	target process
PID 4460 set thread context of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe

description	pid	process
Token: SeDebugPrivilege	4460	config.dll.exe
Token: SeDebugPrivilege	1100	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

config.dll.exe

description	pid	process	target process
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe
PID 4460 wrote to memory of 1100	4460	config.dll.exe	aspnet_regbrowsers.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

memory/1100-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1100-139-0x0000000005D80000-0x0000000006398000-memory.dmp

Filesize
6.1MB

Download
memory/1100-140-0x00000000056E0000-0x00000000056F2000-memory.dmp

Filesize
72KB

Download
memory/1100-141-0x0000000005760000-0x000000000579C000-memory.dmp

Filesize
240KB

Download
memory/1100-142-0x00000000059F0000-0x0000000005AFA000-memory.dmp

Filesize
1.0MB

Download
memory/1100-143-0x0000000005750000-0x0000000005760000-memory.dmp

Filesize
64KB

Download
memory/1100-144-0x0000000006A50000-0x0000000006C12000-memory.dmp

Filesize
1.8MB

Download
memory/1100-145-0x0000000007150000-0x000000000767C000-memory.dmp

Filesize
5.2MB

Download
memory/4460-133-0x00000000000A0000-0x00000000000A8000-memory.dmp

Filesize
32KB

Download
memory/4460-134-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4460-135-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/4460-136-0x0000000005620000-0x00000000056BC000-memory.dmp

Filesize
624KB

Download