redline | 5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
08/06/2023, 10:35

Target

5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe
Size

309KB
MD5

63315c91cfad4baca419a337767bc9b5
SHA1

1bb12367b8b11a7bd54d8b7310b1f67d5a671ec0
SHA256

5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64
SHA512

17423cfd5f2cf4e6f7a9d52b5508744fab6c2d7d9fd8309c213bb8e42f77387ef69b8e0df1ae1338ef24294ccfe0d9cb220d9999d3e4eaa56e84c42e1d29d9cc
SSDEEP

6144:wD5k3As3xGy6FMqAewvTygXUNVS4MGh1aBFrvz1xcxc7N0:wD20yTqA1yR1aBFrvz1xcxo0

Score

10^/10

Family

redline

Botnet

sheron

83.97.73.129:19068

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3240 set thread context of 4464	3240	5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	3240	WerFault.exe	65

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4464	3240	5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe	67
PID 3240 wrote to memory of 4464	3240	5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe	67
PID 3240 wrote to memory of 4464	3240	5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe	67
PID 3240 wrote to memory of 4464	3240	5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe	67
PID 3240 wrote to memory of 4464	3240	5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe	67

C:\Users\Admin\AppData\Local\Temp\5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe
"C:\Users\Admin\AppData\Local\Temp\5de35859694f372a874daeabab283fd0ce60955a210187323dd9bc83dde4fb64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 144
  2⤵
  - Program crash
  PID:1340

memory/4464-117-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4464-125-0x0000000005480000-0x0000000005486000-memory.dmp

Filesize
24KB

Download
memory/4464-126-0x00000000099E0000-0x0000000009FE6000-memory.dmp

Filesize
6.0MB

Download
memory/4464-127-0x00000000094E0000-0x00000000095EA000-memory.dmp

Filesize
1.0MB

Download
memory/4464-128-0x0000000006E00000-0x0000000006E12000-memory.dmp

Filesize
72KB

Download
memory/4464-129-0x00000000093D0000-0x000000000940E000-memory.dmp

Filesize
248KB

Download
memory/4464-130-0x00000000093C0000-0x00000000093D0000-memory.dmp

Filesize
64KB

Download
memory/4464-131-0x0000000009410000-0x000000000945B000-memory.dmp

Filesize
300KB

Download
memory/4464-148-0x00000000093C0000-0x00000000093D0000-memory.dmp

Filesize
64KB

Download