redline | 7388f2a95e0841dd6bd2d202ee7249c605a53bcc8b3716fea383731cd5826772

Analysis

max time kernel
134s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 06:30

Target

dcef62b1b7d4b44126394e485db504c9.exe
Size

3.0MB
MD5

dcef62b1b7d4b44126394e485db504c9
SHA1

8550b1b600151b52088bd63ce7eeee533b81ff56
SHA256

7388f2a95e0841dd6bd2d202ee7249c605a53bcc8b3716fea383731cd5826772
SHA512

568236b1902210f4d3edf19b01e456f2144421e22f0cbb4c6738d3c29da1e5bef97c1e1f24b9a39419e961425f77e258102e3c03deb9710b138a189e5511d17d
SSDEEP

6144:2GmWmLFEFK2iNQHCuAzd3sU1OI+IkEUnGOiBSoeFt8JSWuPf:2JWmLFEFUapLbUOiBSo4tkSWuPf

Score

10^/10

Family

redline

23.27.163.212:20482

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1524	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2576	1524	dcef62b1b7d4b44126394e485db504c9.exe	29
PID 1524 wrote to memory of 2064	1524	dcef62b1b7d4b44126394e485db504c9.exe	30
PID 1524 wrote to memory of 2064	1524	dcef62b1b7d4b44126394e485db504c9.exe	30
PID 1524 wrote to memory of 2064	1524	dcef62b1b7d4b44126394e485db504c9.exe	30
PID 1524 wrote to memory of 2064	1524	dcef62b1b7d4b44126394e485db504c9.exe	30

C:\Users\Admin\AppData\Local\Temp\dcef62b1b7d4b44126394e485db504c9.exe
"C:\Users\Admin\AppData\Local\Temp\dcef62b1b7d4b44126394e485db504c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 36
  2⤵
  - Program crash
  PID:2064

memory/1524-54-0x00000000013D0000-0x00000000016DB000-memory.dmp

Filesize
3.0MB

Download
memory/2576-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2576-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2576-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-63-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2576-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2576-64-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-65-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2576-66-0x0000000000980000-0x00000000009C0000-memory.dmp

Filesize
256KB

Download
memory/2576-67-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-68-0x0000000000980000-0x00000000009C0000-memory.dmp

Filesize
256KB

Download