redline | 00f3d069d6b0df663223b54552695c90e33fdf049466e48c1a794312ef1854e8

Analysis

max time kernel
292s
max time network
307s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-10-2023 07:10

Target

j7464231.exe
Size

310KB
MD5

785964441bf75233d9a0e900d791b0ec
SHA1

0b2be90f3d98b8efce0f0c9339b4108f8e94cda6
SHA256

00f3d069d6b0df663223b54552695c90e33fdf049466e48c1a794312ef1854e8
SHA512

1dff833f36a5952b9fc9bcf5eb3ffdcb9e6292f2401d78f5efcd544848097bb5f3a484ddf4a81cfd8908986b9c4239286e57bb4905c9cde9fab945ea841c974f
SSDEEP

6144:WhzDq0Bru5tnsqWQYeamN4nXyohSUGzOjrj:Wtq0BruRa+yXyohSo/j

Score

10^/10

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

j7464231.exe

description pid process target process

PID 2860 set thread context of 2704 2860 j7464231.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2332 2860 WerFault.exe j7464231.exe

description	pid	process	target process
PID 2860 set thread context of 2704	2860	j7464231.exe	AppLaunch.exe

pid	pid_target	process	target process
2332	2860	WerFault.exe	j7464231.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

j7464231.exe

description	pid	process	target process
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2704	2860	j7464231.exe	AppLaunch.exe
PID 2860 wrote to memory of 2332	2860	j7464231.exe	WerFault.exe
PID 2860 wrote to memory of 2332	2860	j7464231.exe	WerFault.exe
PID 2860 wrote to memory of 2332	2860	j7464231.exe	WerFault.exe
PID 2860 wrote to memory of 2332	2860	j7464231.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 68
2⤵
- Program crash
PID:2332

memory/2704-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2704-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2704-10-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2704-11-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2704-12-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/2704-13-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2704-14-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download