redline | bb63b3e2db3819a6b9d7a0c3e28157b8ba45c7ea6012ecb66ee6d7d18da62ff0

Analysis

max time kernel
154s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 12:36

Target

data64_1.exe
Size

175KB
MD5

bbdb74f2c6542aeeb854b0f1a3962379
SHA1

0042e99fb477e0b68831fcd7948ea46fa9c25993
SHA256

bb63b3e2db3819a6b9d7a0c3e28157b8ba45c7ea6012ecb66ee6d7d18da62ff0
SHA512

740a56042008622c4faedb4a723abd24d68d27c45313ddef04f9d9bbd92ab5f9070a96ea0b4014fc1249affd6e75d9bb6889e3bb6f6c2359169516901b23bfec
SSDEEP

3072:vqw26dxriPBJ8d+z12/5JUICTiSV/byO7e3TTYhAa6Yo/HKO/9Rs7Zu:z2AriETUVZDyO7e3TTYhR6lHKO/9Rs7Z

Score

10^/10

Family

redline

Botnet

topp

blcesalenial.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

data64_1.exe

description pid process target process

PID 1668 set thread context of 1480 1668 data64_1.exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

612 1668 WerFault.exe data64_1.exe

description	pid	process	target process
PID 1668 set thread context of 1480	1668	data64_1.exe	MSBuild.exe

pid	pid_target	process	target process
612	1668	WerFault.exe	data64_1.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

data64_1.exe

description	pid	process	target process
PID 1668 wrote to memory of 1480	1668	data64_1.exe	MSBuild.exe
PID 1668 wrote to memory of 1480	1668	data64_1.exe	MSBuild.exe
PID 1668 wrote to memory of 1480	1668	data64_1.exe	MSBuild.exe
PID 1668 wrote to memory of 1480	1668	data64_1.exe	MSBuild.exe
PID 1668 wrote to memory of 1480	1668	data64_1.exe	MSBuild.exe
PID 1668 wrote to memory of 1480	1668	data64_1.exe	MSBuild.exe
PID 1668 wrote to memory of 612	1668	data64_1.exe	WerFault.exe
PID 1668 wrote to memory of 612	1668	data64_1.exe	WerFault.exe
PID 1668 wrote to memory of 612	1668	data64_1.exe	WerFault.exe
PID 1668 wrote to memory of 612	1668	data64_1.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 92
2⤵
- Program crash
PID:612

memory/1480-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1480-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1480-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1480-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1480-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1480-64-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download