redline | f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2023 11:14

Target

generator.dll.exe
Size

12KB
MD5

03c3f979feffbf02e7ab9a66f9a1f7b4
SHA1

826e5038b32c3975821eb8641e484b575fdfa7e9
SHA256

f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd
SHA512

14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea
SSDEEP

192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6

Score

10^/10

Family

redline

Botnet

Love Fi Lo

111.90.149.195:55186

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3868-137-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3868-137-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

generator.dll.exe

description pid process target process

PID 3304 set thread context of 3868 3304 generator.dll.exe aspnet_regbrowsers.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

generator.dll.exeaspnet_regbrowsers.exe

description pid process

Token: SeDebugPrivilege 3304 generator.dll.exe
Token: SeDebugPrivilege 3868 aspnet_regbrowsers.exe

description	pid	process	target process
PID 3304 set thread context of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe

description	pid	process
Token: SeDebugPrivilege	3304	generator.dll.exe
Token: SeDebugPrivilege	3868	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

generator.dll.exe

description	pid	process	target process
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe
PID 3304 wrote to memory of 3868	3304	generator.dll.exe	aspnet_regbrowsers.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868

memory/3304-133-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/3304-134-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3304-135-0x0000000004C70000-0x0000000004C80000-memory.dmp

Filesize
64KB

Download
memory/3304-136-0x0000000005920000-0x00000000059BC000-memory.dmp

Filesize
624KB

Download
memory/3868-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3868-139-0x0000000005AD0000-0x00000000060E8000-memory.dmp

Filesize
6.1MB

Download
memory/3868-140-0x0000000005420000-0x0000000005432000-memory.dmp

Filesize
72KB

Download
memory/3868-141-0x00000000054B0000-0x00000000054EC000-memory.dmp

Filesize
240KB

Download
memory/3868-142-0x00000000054A0000-0x00000000054B0000-memory.dmp

Filesize
64KB

Download
memory/3868-143-0x0000000005730000-0x000000000583A000-memory.dmp

Filesize
1.0MB

Download
memory/3868-144-0x00000000054A0000-0x00000000054B0000-memory.dmp

Filesize
64KB

Download
memory/3868-145-0x0000000006790000-0x0000000006952000-memory.dmp

Filesize
1.8MB

Download
memory/3868-146-0x0000000006E90000-0x00000000073BC000-memory.dmp

Filesize
5.2MB

Download