redline | a09a8f63ea1e5aa0da9567588c9a9f6b8c5f587a24ce603612b9aebc31637f66

Analysis

max time kernel
290s
max time network
308s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-10-2023 07:07

Target

j3160085.exe
Size

390KB
MD5

4b307137183cd33be6ac81af694721ba
SHA1

ba1c9d62e7e97447c9c140e0df9574b1f9705a78
SHA256

a09a8f63ea1e5aa0da9567588c9a9f6b8c5f587a24ce603612b9aebc31637f66
SHA512

e5e3d8203f8801f698a1006f7976041219efb0269b63e5f714041488a3a302adcce5c22f221f2b5e349cdec2d4bf1e2520ead1b9606f0ace44c51c6875b1a3d8
SSDEEP

6144:YvXFo/N5ExgFbNOUAHEHIXbLvZAOixYPdgz0Tjxdy8MVs0BC+:IwDExgFY5vx0xudG0/q8Is0BC+

Score

10^/10

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j3160085.exe

description pid process target process

PID 2188 set thread context of 1748 2188 j3160085.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2688 2188 WerFault.exe j3160085.exe

description	pid	process	target process
PID 2188 set thread context of 1748	2188	j3160085.exe	AppLaunch.exe

pid	pid_target	process	target process
2688	2188	WerFault.exe	j3160085.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

j3160085.exe

description	pid	process	target process
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 1748	2188	j3160085.exe	AppLaunch.exe
PID 2188 wrote to memory of 2688	2188	j3160085.exe	WerFault.exe
PID 2188 wrote to memory of 2688	2188	j3160085.exe	WerFault.exe
PID 2188 wrote to memory of 2688	2188	j3160085.exe	WerFault.exe
PID 2188 wrote to memory of 2688	2188	j3160085.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 76
2⤵
- Program crash
PID:2688

memory/1748-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1748-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1748-10-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/1748-11-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1748-12-0x00000000006B0000-0x00000000006F0000-memory.dmp

Filesize
256KB

Download
memory/1748-13-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/1748-14-0x00000000006B0000-0x00000000006F0000-memory.dmp

Filesize
256KB

Download