redline | f18ee2360eb587bdf735ce3886c728f54cace99210a6528adf5846e911a3e01b

Analysis

max time kernel
292s
max time network
301s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19-09-2023 06:53

Target

j5220189.exe
Size

399KB
MD5

6911db4059e254077f03d58ef899a334
SHA1

dd476b4e26a3e102998886a5c111fe4a493a9a21
SHA256

f18ee2360eb587bdf735ce3886c728f54cace99210a6528adf5846e911a3e01b
SHA512

e5f6f56205672df854a0e942f51f070f1bc395c3d547d3f271ac28807cf390b5b71c6cc783771ae25648cb7fea0dfb2275264ee23ad6fe59ab17ff0690427f37
SSDEEP

6144:+jpjE12jicP5iOo2T8VrSd/sUAO8clkwUv5M3pQ1xeKM7ZzuF9iHpFGazEU1Sa:+jpcqiG59ouecGteKMFo9SN51Sa

Score

10^/10

Family

redline

Botnet

monik

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j5220189.exe

description pid process target process

PID 1516 set thread context of 4636 1516 j5220189.exe AppLaunch.exe

description	pid	process	target process
PID 1516 set thread context of 4636	1516	j5220189.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

j5220189.exe

description	pid	process	target process
PID 1516 wrote to memory of 2780	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 2780	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 2780	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe
PID 1516 wrote to memory of 4636	1516	j5220189.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\j5220189.exe
"C:\Users\Admin\AppData\Local\Temp\j5220189.exe"
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:2780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
PID:4636

memory/4636-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4636-5-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6MB

Download
memory/4636-4-0x00000000066A0000-0x00000000066A6000-memory.dmp

Filesize
24KB

Download
memory/4636-6-0x000000000E730000-0x000000000ED36000-memory.dmp

Filesize
6MB

Download
memory/4636-7-0x000000000E230000-0x000000000E33A000-memory.dmp

Filesize
1MB

Download
memory/4636-8-0x0000000008C90000-0x0000000008CA0000-memory.dmp

Filesize
64KB

Download
memory/4636-9-0x000000000E150000-0x000000000E162000-memory.dmp

Filesize
72KB

Download
memory/4636-10-0x000000000E1B0000-0x000000000E1EE000-memory.dmp

Filesize
248KB

Download
memory/4636-11-0x000000000E340000-0x000000000E38B000-memory.dmp

Filesize
300KB

Download
memory/4636-16-0x0000000073DA0000-0x000000007448E000-memory.dmp

Filesize
6MB

Download
memory/4636-17-0x0000000008C90000-0x0000000008CA0000-memory.dmp

Filesize
64KB

Download