redline | f004a6b85ea2006cf3849e4ddee42a2df74a43707c835ef916344d565d2dccff

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/06/2023, 06:57

Target

GENSHIN_ESP_AIM.exe
Size

367KB
MD5

403512d851024c4e3efb3cf61e5058d1
SHA1

24354abc6d58b9d4fc4d95380e7639473b2b45e5
SHA256

f004a6b85ea2006cf3849e4ddee42a2df74a43707c835ef916344d565d2dccff
SHA512

962f157e2d43142abc74ab728919693937ac61ac9107787c393929b26cb23c5e2846567873404b287f747df1b3c66f87c6cec14345b46079f77e49845842724c
SSDEEP

3072:zcSg6LmU8Rz+644/mEymgPvwiDmR0yW5IKQOzOUax7glWBJtCziX8sbSXXq5iRym:Axm6zHi8WmhOba7gluJoeXphiom

Score

10^/10

Family

redline

Botnet

835252574

disdoctor.top:40309

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 1036	1240	GENSHIN_ESP_AIM.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28
PID 1240 wrote to memory of 1036	1240	GENSHIN_ESP_AIM.exe	28

C:\Users\Admin\AppData\Local\Temp\GENSHIN_ESP_AIM.exe
"C:\Users\Admin\AppData\Local\Temp\GENSHIN_ESP_AIM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1036

memory/1036-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1036-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1036-63-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1036-62-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1036-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1036-64-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/1036-65-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download