redline | cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 06:00

Target

cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe
Size

282KB
MD5

543592305a9b8cc484478d78f10476e7
SHA1

af9fe29fa22c158632331f8fce870ae54dc46aab
SHA256

cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559
SHA512

64c489ebb7508b5f219a841670f47178d6254dda08d0cab75ca1d7b32bb4c51c17aa08bf0de97cf48f5c2b10f095d3f65797761192038455af7131bf276d1d54
SSDEEP

6144:5QvoWvJqybt1wvTygXUNVS4MGh1aBFrvz1xcxcWh0rt:5UAIgyR1aBFrvz1xcxd0rt

Score

10^/10

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe

description	pid	process	target process
PID 4192 set thread context of 4168	4192	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4524 4192 WerFault.exe cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe

pid	pid_target	process	target process
4524	4192	WerFault.exe	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe

description	pid	process	target process
PID 4192 wrote to memory of 4168	4192	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe	AppLaunch.exe
PID 4192 wrote to memory of 4168	4192	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe	AppLaunch.exe
PID 4192 wrote to memory of 4168	4192	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe	AppLaunch.exe
PID 4192 wrote to memory of 4168	4192	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe	AppLaunch.exe
PID 4192 wrote to memory of 4168	4192	cb1b47fd2872bac1b51e222931e4cce652be24707aed6c2c725e36648d663559.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 496
2⤵
- Program crash
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4192 -ip 4192
1⤵
PID:716

memory/4168-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4168-138-0x0000000005D60000-0x0000000006378000-memory.dmp

Filesize
6.1MB

Download
memory/4168-139-0x0000000005850000-0x000000000595A000-memory.dmp

Filesize
1.0MB

Download
memory/4168-140-0x00000000055D0000-0x00000000055E2000-memory.dmp

Filesize
72KB

Download
memory/4168-141-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/4168-142-0x0000000005740000-0x000000000577C000-memory.dmp

Filesize
240KB

Download
memory/4168-143-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download