redline | 6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4

Analysis

max time kernel
141s
max time network
143s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2023, 13:49

Target

6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe
Size

262KB
MD5

eaa803d067df55ec1c57f121c4e68b0a
SHA1

b9809943c5c81e5a51745db970ca3c9527f813ee
SHA256

6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4
SHA512

e25cd012a6f61a543e7218a9d456c00c3641556e7311f3e50e04ac2b2caf817181998cdeb5ee40a933f9a2080ec5cd665c28ff96a3be29cef2c09932be670021
SSDEEP

3072:Ox/qx1OuyRyXFaQ7RQ05CTEezbClXv8r8+oFe6gobFHFzA+E+2SUHcj/:a/qx1aEFaQ7W05AEezbMPZFzAy2Sc

Score

10^/10

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 2144	4048	6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4264	4048	WerFault.exe	65

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2144	4048	6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe	67
PID 4048 wrote to memory of 2144	4048	6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe	67
PID 4048 wrote to memory of 2144	4048	6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe	67
PID 4048 wrote to memory of 2144	4048	6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe	67
PID 4048 wrote to memory of 2144	4048	6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe	67

C:\Users\Admin\AppData\Local\Temp\6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe
"C:\Users\Admin\AppData\Local\Temp\6094d7eff6f3e224d049d09ab4a981c76a12a83f17f8160d5a98b59144a790f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 236
  2⤵
  - Program crash
  PID:4264

memory/2144-121-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2144-129-0x00000000069B0000-0x00000000069B6000-memory.dmp

Filesize
24KB

Download
memory/2144-130-0x000000000EB50000-0x000000000F156000-memory.dmp

Filesize
6.0MB

Download
memory/2144-131-0x000000000E650000-0x000000000E75A000-memory.dmp

Filesize
1.0MB

Download
memory/2144-132-0x000000000E570000-0x000000000E582000-memory.dmp

Filesize
72KB

Download
memory/2144-133-0x000000000E5D0000-0x000000000E60E000-memory.dmp

Filesize
248KB

Download
memory/2144-134-0x000000000E760000-0x000000000E7AB000-memory.dmp

Filesize
300KB

Download
memory/2144-135-0x00000000090B0000-0x00000000090C0000-memory.dmp

Filesize
64KB

Download
memory/2144-140-0x00000000090B0000-0x00000000090C0000-memory.dmp

Filesize
64KB

Download
memory/2144-141-0x0000000004FE0000-0x0000000005056000-memory.dmp

Filesize
472KB

Download
memory/2144-142-0x000000000E940000-0x000000000E9D2000-memory.dmp

Filesize
584KB

Download
memory/2144-143-0x000000000F660000-0x000000000FB5E000-memory.dmp

Filesize
5.0MB

Download
memory/2144-146-0x0000000005140000-0x00000000051A6000-memory.dmp

Filesize
408KB

Download