redline | c42efcd5f53c75f36a6ed5c8f8be82359b848285ffb0fc5acc12fbd625c7028e

Analysis

max time kernel
291s
max time network
298s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 05:01

Target

4Kk154NZ.exe
Size

459KB
MD5

a38ce3e2dc246d8e40f95186737c588f
SHA1

87eb3f865fdd506f345d1d586f4d8c4d490f669a
SHA256

c42efcd5f53c75f36a6ed5c8f8be82359b848285ffb0fc5acc12fbd625c7028e
SHA512

9b6dec7f0eaae988f522ec927e0082dd03ead7605387c52d6184ee899154c85e9f180622b7ca32377a9e9a0b1972e24131e0a47e2b27797c55736b25261d27c9
SSDEEP

6144:+fqhmbDPM4jjdpvIN8fp7z5BAOiU/Eiz/1mub3+pb4cu9bRl/R+oY0X:+fqaDPjjb/kU/DmubOpb4cGbRrX

Score

10^/10

Family

redline

Botnet

frant

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2396-11-0x00000000072D0000-0x0000000007310000-memory.dmp	family_redline
behavioral1/memory/2396-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2396-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2396-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2396-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2396-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

4Kk154NZ.exe

description pid process target process

PID 1888 set thread context of 2396 1888 4Kk154NZ.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2996 1888 WerFault.exe

description	pid	process	target process
PID 1888 set thread context of 2396	1888	4Kk154NZ.exe	AppLaunch.exe

pid	pid_target	process
2996	1888	WerFault.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

4Kk154NZ.exe

description	pid	process	target process
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2396	1888	4Kk154NZ.exe	AppLaunch.exe
PID 1888 wrote to memory of 2996	1888	4Kk154NZ.exe	WerFault.exe
PID 1888 wrote to memory of 2996	1888	4Kk154NZ.exe	WerFault.exe
PID 1888 wrote to memory of 2996	1888	4Kk154NZ.exe	WerFault.exe
PID 1888 wrote to memory of 2996	1888	4Kk154NZ.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 136
1⤵
- Program crash
PID:2996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
1⤵
PID:2396

memory/2396-11-0x00000000072D0000-0x0000000007310000-memory.dmp

Filesize
256KB

Download
memory/2396-10-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2396-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-12-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-13-0x00000000072D0000-0x0000000007310000-memory.dmp

Filesize
256KB

Download