redline | d2a009b0a6e8103314d32782aa1510615a6b5ed1d996fea9aaa46c49d2abb1b1

Analysis

max time kernel
290s
max time network
302s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:52

Target

j3405793.exe
Size

399KB
MD5

11dbb5b629e4e609f737591f4842389e
SHA1

75bbb1243da988a5f5282ace12a42c12dd3eda16
SHA256

d2a009b0a6e8103314d32782aa1510615a6b5ed1d996fea9aaa46c49d2abb1b1
SHA512

8f8fd4fe1eb184244bcf10fd1166f60e49fd1f72fc2e9bea442dc769f722c75a4067baf511de007429e424d8798243e2184e520f98df88fd725733461556e65f
SSDEEP

6144:Ng5jEL2jicP5iOo2T8VrSd/sUAODcl0cxOSFKVu7I8F51Sa:Ng5eqiG59ouBcucxOSI0F51Sa

Score

10^/10

Family

redline

Botnet

prets

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j3405793.exe

description pid process target process

PID 2200 set thread context of 1892 2200 j3405793.exe AppLaunch.exe

description	pid	process	target process
PID 2200 set thread context of 1892	2200	j3405793.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

j3405793.exe

description	pid	process	target process
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe
PID 2200 wrote to memory of 1892	2200	j3405793.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\j3405793.exe
"C:\Users\Admin\AppData\Local\Temp\j3405793.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:1892

memory/1892-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1892-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-6-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-10-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1892-11-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6MB

Download
memory/1892-12-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/1892-13-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1892-14-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6MB

Download
memory/1892-15-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download