redline | 7fcefdae6d01431202b30b4b18eac815bc05a9e6dcc18b18b5055e4942aa5be7

Analysis

max time kernel
291s
max time network
303s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
12-09-2023 06:11

Target

k8303888.exe
Size

419KB
MD5

5debbb56195829875cdceed4422c632c
SHA1

28f70c3d8269b56ea63495d75b03ccdfe016ea1e
SHA256

7fcefdae6d01431202b30b4b18eac815bc05a9e6dcc18b18b5055e4942aa5be7
SHA512

6006c457ba521597902c234233cd44ccc364c8380cd3f6ad7a475b91b28beea97318378af96e7907377c6261c1b0af7234b3590b0167e1eeb8b39f79de5c86ad
SSDEEP

6144:5Yba2/KMiCQy4bwSjQzL9ois436xMhAOjb74g/SiHQeMbbwbbbyGA3Lp:5x2SMiu4Ms436xMhNbWKMbbwbbby3t

Score

10^/10

Family

redline

Botnet

tuco

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

k8303888.exe

description pid process target process

PID 2948 set thread context of 3012 2948 k8303888.exe AppLaunch.exe

description	pid	process	target process
PID 2948 set thread context of 3012	2948	k8303888.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

k8303888.exe

description	pid	process	target process
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe
PID 2948 wrote to memory of 3012	2948	k8303888.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3012

memory/3012-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3012-4-0x00000000732E0000-0x00000000739CE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-5-0x0000000004F40000-0x0000000004F46000-memory.dmp

Filesize
24KB

Download
memory/3012-6-0x000000000EB50000-0x000000000F156000-memory.dmp

Filesize
6.0MB

Download
memory/3012-7-0x000000000E650000-0x000000000E75A000-memory.dmp

Filesize
1.0MB

Download
memory/3012-8-0x00000000090B0000-0x00000000090C0000-memory.dmp

Filesize
64KB

Download
memory/3012-9-0x0000000009020000-0x0000000009032000-memory.dmp

Filesize
72KB

Download
memory/3012-10-0x000000000E540000-0x000000000E57E000-memory.dmp

Filesize
248KB

Download
memory/3012-11-0x000000000E580000-0x000000000E5CB000-memory.dmp

Filesize
300KB

Download
memory/3012-16-0x00000000732E0000-0x00000000739CE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-17-0x00000000090B0000-0x00000000090C0000-memory.dmp

Filesize
64KB

Download