redline | 5459835af56f5d5fd3bf0a3abb1cedc126a63c57eef8c0bcbd797366177a8f0d

Analysis

max time kernel
128s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 05:46

Target

8218e24698a7118d8377e60c30d92341.exe
Size

201KB
MD5

8218e24698a7118d8377e60c30d92341
SHA1

0219cab4c3d1203badfc6666ab632ac5c29946f1
SHA256

5459835af56f5d5fd3bf0a3abb1cedc126a63c57eef8c0bcbd797366177a8f0d
SHA512

21354dd4d9d8df643f8117e7a029361a2368d5ae7f6edace27e8bdb2797aba453b0b003820bfe9391783c847438438ff7b45afe872640dc3befcf1357005d7f6
SSDEEP

3072:KxLeZ1gif5JlqfrtfugOQU7sJn9XQHwKSMHkZtERVsJtyAip0QMvB:eLNJDVSfkZQQKSmetE+tUp0QMv

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2896-135-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1796 set thread context of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4076	2896	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	8218e24698a7118d8377e60c30d92341.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82
PID 1796 wrote to memory of 2896	1796	8218e24698a7118d8377e60c30d92341.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2896 -ip 2896
1⤵
PID:2724

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8218e24698a7118d8377e60c30d92341.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
memory/1796-133-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/1796-134-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/1796-139-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/2896-135-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2896-138-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/2896-140-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download