redline | e791a42ab7baf1299bbc3bc6de9c72ca65cb9464a200eee17e530fa3b272f680

Analysis

max time kernel
293s
max time network
299s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:52

Target

j0811965.exe
Size

405KB
MD5

95882a04cf43e9e5881417bc8e0ec5b7
SHA1

02788585baeecb70d2a7a5f8af72511044aa8b8f
SHA256

e791a42ab7baf1299bbc3bc6de9c72ca65cb9464a200eee17e530fa3b272f680
SHA512

0e652afd5b5511dd20e94aee91be3632bbaab1dee2689871148cdbf84e060359195ffa7f86ea2b0d91d6cdf84035211272fcedaa41173029477689f7327e90d4
SSDEEP

6144:F3vJm09zORs+z/TMify9DAOooQRfF45C4NHe7Lcm8/:Ffw09CK5NfMfF45L+7LX8/

Score

10^/10

Family

redline

Botnet

monik

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j0811965.exe

description pid process target process

PID 1576 set thread context of 2156 1576 j0811965.exe AppLaunch.exe

description	pid	process	target process
PID 1576 set thread context of 2156	1576	j0811965.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

j0811965.exe

description	pid	process	target process
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe
PID 1576 wrote to memory of 2156	1576	j0811965.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\j0811965.exe
"C:\Users\Admin\AppData\Local\Temp\j0811965.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:2156

memory/2156-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2156-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2156-10-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6MB

Download
memory/2156-11-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2156-12-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2156-13-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6MB

Download
memory/2156-14-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download