redline | f37fed756590b0b03fb03dc3802b589cc5751346914048faab47b003bae832bb

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/06/2023, 19:45

Target

08575099.exe
Size

926KB
MD5

a1ed05e1152357a287ad4c4b4ddc300e
SHA1

e9a0fb950bbe24c907cfcbf4183654592351ca4a
SHA256

f37fed756590b0b03fb03dc3802b589cc5751346914048faab47b003bae832bb
SHA512

a090022d23a6c0e9b65e87a9a09c52729b690f95ccb476a847377a6538a8380fd2e8853e2bcd914464fd829394dc52cd74ae3916a8a7863563723852c4d1d438
SSDEEP

12288:Sm8VMj5EcETVXfz0kSn69pjVvMEeCxeCadKeHuXq97HvBjTjCdxBT4ZbCAAb7BhT:SxKcSup5UrUF3

Score

10^/10

Family

redline

Botnet

185.215.113.37:31712

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 2008	1204	08575099.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	2008	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	08575099.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 1204 wrote to memory of 2008	1204	08575099.exe	28
PID 2008 wrote to memory of 560	2008	08575099.exe	29
PID 2008 wrote to memory of 560	2008	08575099.exe	29
PID 2008 wrote to memory of 560	2008	08575099.exe	29
PID 2008 wrote to memory of 560	2008	08575099.exe	29

memory/1204-54-0x0000000000F50000-0x000000000103E000-memory.dmp

Filesize
952KB

Download
memory/1204-55-0x0000000007020000-0x0000000007060000-memory.dmp

Filesize
256KB

Download
memory/2008-56-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2008-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2008-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2008-61-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download