redline | d2a009b0a6e8103314d32782aa1510615a6b5ed1d996fea9aaa46c49d2abb1b1

Analysis

max time kernel
291s
max time network
305s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:52

Target

j3405793.exe
Size

399KB
MD5

11dbb5b629e4e609f737591f4842389e
SHA1

75bbb1243da988a5f5282ace12a42c12dd3eda16
SHA256

d2a009b0a6e8103314d32782aa1510615a6b5ed1d996fea9aaa46c49d2abb1b1
SHA512

8f8fd4fe1eb184244bcf10fd1166f60e49fd1f72fc2e9bea442dc769f722c75a4067baf511de007429e424d8798243e2184e520f98df88fd725733461556e65f
SSDEEP

6144:Ng5jEL2jicP5iOo2T8VrSd/sUAODcl0cxOSFKVu7I8F51Sa:Ng5eqiG59ouBcucxOSI0F51Sa

Score

10^/10

Family

redline

Botnet

prets

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j3405793.exe

description pid process target process

PID 2332 set thread context of 3884 2332 j3405793.exe AppLaunch.exe

description	pid	process	target process
PID 2332 set thread context of 3884	2332	j3405793.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

j3405793.exe

description	pid	process	target process
PID 2332 wrote to memory of 224	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 224	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 224	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3920	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3920	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3920	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe
PID 2332 wrote to memory of 3884	2332	j3405793.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\j3405793.exe
"C:\Users\Admin\AppData\Local\Temp\j3405793.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:3920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:3884

memory/3884-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3884-4-0x0000000073880000-0x0000000073F6E000-memory.dmp

Filesize
6MB

Download
memory/3884-5-0x0000000005030000-0x0000000005036000-memory.dmp

Filesize
24KB

Download
memory/3884-6-0x0000000009640000-0x0000000009C46000-memory.dmp

Filesize
6MB

Download
memory/3884-7-0x0000000009140000-0x000000000924A000-memory.dmp

Filesize
1MB

Download
memory/3884-9-0x0000000008F20000-0x0000000008F30000-memory.dmp

Filesize
64KB

Download
memory/3884-8-0x0000000006940000-0x0000000006952000-memory.dmp

Filesize
72KB

Download
memory/3884-10-0x0000000008E40000-0x0000000008E7E000-memory.dmp

Filesize
248KB

Download
memory/3884-11-0x0000000008E80000-0x0000000008ECB000-memory.dmp

Filesize
300KB

Download
memory/3884-16-0x0000000073880000-0x0000000073F6E000-memory.dmp

Filesize
6MB

Download
memory/3884-17-0x0000000008F20000-0x0000000008F30000-memory.dmp

Filesize
64KB

Download