redline | 69fea51cac73ae89b6d188508d3c846b66d24bca74de54a3f7c2bc1df17aac27

Analysis

max time kernel
37s
max time network
79s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06-07-2023 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

COD warzone aimbot+wallhack.exe
Size

734.4MB
MD5

3bbe3890090436d672cb607c0ac51d15
SHA1

871588b00e89787c0c578fef854f0eb17131c5c2
SHA256

b6da030f790e7056b5cf054da861510f68105b0ce9263a2d43f312869ca4ec9d
SHA512

3785cd391038e8479e4fd79d9f492365ee2c4f049dba493b2c84f289065dff740cb732ebaab22e8e5831769c50ea4b183ef3c0e7b1f824dc9ba98b684375f99f
SSDEEP

12582912:QQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyq:Qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnq

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2248-54-0x0000000000D60000-0x0000000000F68000-memory.dmp	family_redline

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	COD warzone aimbot+wallhack.exe
2248	COD warzone aimbot+wallhack.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	COD warzone aimbot+wallhack.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3044	2248	COD warzone aimbot+wallhack.exe	29
PID 2248 wrote to memory of 3044	2248	COD warzone aimbot+wallhack.exe	29
PID 2248 wrote to memory of 3044	2248	COD warzone aimbot+wallhack.exe	29
PID 2248 wrote to memory of 3044	2248	COD warzone aimbot+wallhack.exe	29

C:\Users\Admin\AppData\Local\Temp\COD warzone aimbot+wallhack.exe
"C:\Users\Admin\AppData\Local\Temp\COD warzone aimbot+wallhack.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-54-0x0000000000D60000-0x0000000000F68000-memory.dmp

Filesize
2.0MB

Download
memory/2248-55-0x0000000000B90000-0x0000000000C14000-memory.dmp

Filesize
528KB

Download
memory/2248-56-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-57-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-59-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-61-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-63-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-64-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2248-66-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2248-67-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-69-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-71-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-73-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-75-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-77-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-79-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-81-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-83-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-85-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-87-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-89-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-91-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-93-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-95-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-97-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-99-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-101-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-103-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-105-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-107-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-109-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-111-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-113-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-115-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-117-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-119-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-121-0x0000000000B90000-0x0000000000C0E000-memory.dmp

Filesize
504KB

Download
memory/2248-122-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download