redline | fe1998a8b0045cb7998f23cf8c2aa6212732db275026e9927adbd991eb940acb

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:32

Target

data64_1.exe
Size

1021KB
MD5

b53bfa77e651cee7bdc9859538b03cd5
SHA1

cc996b0128561987a750478a2e8168ef59f0a65f
SHA256

fe1998a8b0045cb7998f23cf8c2aa6212732db275026e9927adbd991eb940acb
SHA512

3ad05a6c1a07ccac7b7a40e53b5e3dd9d07820fa318bbc34ba248a524a70bf93500149ceb9abe2a929ce48291fb422c312521938d8d141cb04bd849103544bb4
SSDEEP

6144:HwBjzfMAReA/SthOjcccfEaLCRixSGag4WRZgu3R:GC

Score

10^/10

Family

redline

Botnet

top1

pemararslava.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

data64_1.exe

description pid process target process

PID 2132 set thread context of 2064 2132 data64_1.exe data64_1.exe

description	pid	process	target process
PID 2132 set thread context of 2064	2132	data64_1.exe	data64_1.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

data64_1.exe

description	pid	process	target process
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe
PID 2132 wrote to memory of 2064	2132	data64_1.exe	data64_1.exe

C:\Users\Admin\AppData\Local\Temp\data64_1.exe
"C:\Users\Admin\AppData\Local\Temp\data64_1.exe"
2⤵
PID:2064

memory/2064-134-0x0000000000DE0000-0x0000000000DFE000-memory.dmp

Filesize
120KB

Download
memory/2064-136-0x0000000005B50000-0x0000000006168000-memory.dmp

Filesize
6.1MB

Download
memory/2064-137-0x00000000055B0000-0x00000000055C2000-memory.dmp

Filesize
72KB

Download
memory/2064-138-0x00000000056E0000-0x00000000057EA000-memory.dmp

Filesize
1.0MB

Download
memory/2064-139-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/2064-140-0x00000000059F0000-0x0000000005A2C000-memory.dmp

Filesize
240KB

Download
memory/2064-141-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/2132-133-0x0000000000960000-0x0000000000A7A000-memory.dmp

Filesize
1.1MB

Download