redline | df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119

Analysis

max time kernel
78s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 06:02

Target

df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe
Size

282KB
MD5

4b28cc8079626f8afda87ce20b86ddce
SHA1

6db15b496e81b712a8150d229c4c826b100db5a9
SHA256

df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119
SHA512

6e416b88c00ec4b67f8501631d988f63383d3d38b6e3a24cb1535b2869d272135c0a422aa74f6e871a34f115956e81b55e4c77266a3d9eb56db940ef2e771943
SSDEEP

6144:5QvoWvJqybt1wvTygXUNVS4MGh1aBFrvz1xcxcWh0rt:5UAIgyR1aBFrvz1xcxd0rt

Score

10^/10

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe

description	pid	process	target process
PID 4436 set thread context of 3928	4436	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4660 4436 WerFault.exe df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe

pid	pid_target	process	target process
4660	4436	WerFault.exe	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe

description	pid	process	target process
PID 4436 wrote to memory of 3928	4436	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe	AppLaunch.exe
PID 4436 wrote to memory of 3928	4436	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe	AppLaunch.exe
PID 4436 wrote to memory of 3928	4436	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe	AppLaunch.exe
PID 4436 wrote to memory of 3928	4436	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe	AppLaunch.exe
PID 4436 wrote to memory of 3928	4436	df0c07c49f2f8a1694ceda757993d088b6f2c9499c0bcbe710fe52db73ac9119.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 152
2⤵
- Program crash
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4436 -ip 4436
1⤵
PID:1168

memory/3928-133-0x0000000000740000-0x0000000000770000-memory.dmp

Filesize
192KB

Download
memory/3928-138-0x000000000A7D0000-0x000000000ADE8000-memory.dmp

Filesize
6.1MB

Download
memory/3928-139-0x000000000A310000-0x000000000A41A000-memory.dmp

Filesize
1.0MB

Download
memory/3928-140-0x000000000A250000-0x000000000A262000-memory.dmp

Filesize
72KB

Download
memory/3928-141-0x000000000A2B0000-0x000000000A2EC000-memory.dmp

Filesize
240KB

Download
memory/3928-142-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/3928-143-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download