redline | f18ee2360eb587bdf735ce3886c728f54cace99210a6528adf5846e911a3e01b

Analysis

max time kernel
292s
max time network
299s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 06:53

Target

j5220189.exe
Size

399KB
MD5

6911db4059e254077f03d58ef899a334
SHA1

dd476b4e26a3e102998886a5c111fe4a493a9a21
SHA256

f18ee2360eb587bdf735ce3886c728f54cace99210a6528adf5846e911a3e01b
SHA512

e5f6f56205672df854a0e942f51f070f1bc395c3d547d3f271ac28807cf390b5b71c6cc783771ae25648cb7fea0dfb2275264ee23ad6fe59ab17ff0690427f37
SSDEEP

6144:+jpjE12jicP5iOo2T8VrSd/sUAO8clkwUv5M3pQ1xeKM7ZzuF9iHpFGazEU1Sa:+jpcqiG59ouecGteKMFo9SN51Sa

Score

10^/10

Family

redline

Botnet

monik

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j5220189.exe

description pid process target process

PID 1700 set thread context of 2132 1700 j5220189.exe AppLaunch.exe

description	pid	process	target process
PID 1700 set thread context of 2132	1700	j5220189.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

j5220189.exe

description	pid	process	target process
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe
PID 1700 wrote to memory of 2132	1700	j5220189.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\j5220189.exe
"C:\Users\Admin\AppData\Local\Temp\j5220189.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:2132

memory/2132-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2132-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2132-10-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6MB

Download
memory/2132-11-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2132-12-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download
memory/2132-13-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6MB

Download
memory/2132-14-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download