redline | c42efcd5f53c75f36a6ed5c8f8be82359b848285ffb0fc5acc12fbd625c7028e

Analysis

max time kernel
291s
max time network
304s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
10-10-2023 01:02

Target

4IN797WF.exe
Size

459KB
MD5

a38ce3e2dc246d8e40f95186737c588f
SHA1

87eb3f865fdd506f345d1d586f4d8c4d490f669a
SHA256

c42efcd5f53c75f36a6ed5c8f8be82359b848285ffb0fc5acc12fbd625c7028e
SHA512

9b6dec7f0eaae988f522ec927e0082dd03ead7605387c52d6184ee899154c85e9f180622b7ca32377a9e9a0b1972e24131e0a47e2b27797c55736b25261d27c9
SSDEEP

6144:+fqhmbDPM4jjdpvIN8fp7z5BAOiU/Eiz/1mub3+pb4cu9bRl/R+oY0X:+fqaDPjjb/kU/DmubOpb4cGbRrX

Score

10^/10

Family

redline

Botnet

frant

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2528-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

4IN797WF.exe

description pid process target process

PID 3384 set thread context of 2528 3384 4IN797WF.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2784 3384 WerFault.exe 4IN797WF.exe

description	pid	process	target process
PID 3384 set thread context of 2528	3384	4IN797WF.exe	AppLaunch.exe

pid	pid_target	process	target process
2784	3384	WerFault.exe	4IN797WF.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4IN797WF.exe

description	pid	process	target process
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe
PID 3384 wrote to memory of 2528	3384	4IN797WF.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 140
2⤵
- Program crash
PID:2784

memory/2528-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-4-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-5-0x000000000B770000-0x000000000BC6E000-memory.dmp

Filesize
5.0MB

Download
memory/2528-6-0x000000000B350000-0x000000000B3E2000-memory.dmp

Filesize
584KB

Download
memory/2528-7-0x000000000B4B0000-0x000000000B4C0000-memory.dmp

Filesize
64KB

Download
memory/2528-8-0x000000000B3F0000-0x000000000B3FA000-memory.dmp

Filesize
40KB

Download
memory/2528-9-0x000000000C280000-0x000000000C886000-memory.dmp

Filesize
6.0MB

Download
memory/2528-10-0x000000000BC70000-0x000000000BD7A000-memory.dmp

Filesize
1.0MB

Download
memory/2528-11-0x000000000B5B0000-0x000000000B5C2000-memory.dmp

Filesize
72KB

Download
memory/2528-12-0x000000000B610000-0x000000000B64E000-memory.dmp

Filesize
248KB

Download
memory/2528-13-0x000000000B650000-0x000000000B69B000-memory.dmp

Filesize
300KB

Download
memory/2528-18-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-19-0x000000000B4B0000-0x000000000B4C0000-memory.dmp

Filesize
64KB

Download