redline | f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 05:49

Target

f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe
Size

282KB
MD5

a59a3349634a37931f5a0355c7fe8ac3
SHA1

1ed82d723ffe9606f7629e13a44e94eb399ad13c
SHA256

f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a
SHA512

a6e9122a947a8e442c37e7f701ba8984384583bf919ec093ee6e0b85cdfa6462c154e3ad86bb2412af650577051ce5fa4ca051f325407a609c91684d5f9a399e
SSDEEP

6144:NQvoWvJ0y0qwvTygXUNVS4MGh1aBFrvz1xcxcWhwrt:NUZ8yR1aBFrvz1xcxdwrt

Score

10^/10

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 4644	2404	f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	2404	WerFault.exe	81

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4644	2404	f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe	83
PID 2404 wrote to memory of 4644	2404	f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe	83
PID 2404 wrote to memory of 4644	2404	f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe	83
PID 2404 wrote to memory of 4644	2404	f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe	83
PID 2404 wrote to memory of 4644	2404	f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe	83

C:\Users\Admin\AppData\Local\Temp\f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe
"C:\Users\Admin\AppData\Local\Temp\f936c76eeea232cd7684c10a3351d21254313ee0e828bdd1198924494bcf712a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 152
  2⤵
  - Program crash
  PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2404 -ip 2404
1⤵
PID:3492

memory/4644-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4644-138-0x0000000005C60000-0x0000000006278000-memory.dmp

Filesize
6.1MB

Download
memory/4644-139-0x0000000005750000-0x000000000585A000-memory.dmp

Filesize
1.0MB

Download
memory/4644-140-0x0000000002F30000-0x0000000002F42000-memory.dmp

Filesize
72KB

Download
memory/4644-141-0x0000000002F90000-0x0000000002FCC000-memory.dmp

Filesize
240KB

Download
memory/4644-142-0x0000000001790000-0x00000000017A0000-memory.dmp

Filesize
64KB

Download
memory/4644-143-0x0000000001790000-0x00000000017A0000-memory.dmp

Filesize
64KB

Download