redline | c42efcd5f53c75f36a6ed5c8f8be82359b848285ffb0fc5acc12fbd625c7028e

Analysis

max time kernel
291s
max time network
310s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
10-10-2023 05:01

Target

4Kk154NZ.exe
Size

459KB
MD5

a38ce3e2dc246d8e40f95186737c588f
SHA1

87eb3f865fdd506f345d1d586f4d8c4d490f669a
SHA256

c42efcd5f53c75f36a6ed5c8f8be82359b848285ffb0fc5acc12fbd625c7028e
SHA512

9b6dec7f0eaae988f522ec927e0082dd03ead7605387c52d6184ee899154c85e9f180622b7ca32377a9e9a0b1972e24131e0a47e2b27797c55736b25261d27c9
SSDEEP

6144:+fqhmbDPM4jjdpvIN8fp7z5BAOiU/Eiz/1mub3+pb4cu9bRl/R+oY0X:+fqaDPjjb/kU/DmubOpb4cGbRrX

Score

10^/10

Family

redline

Botnet

frant

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3828-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

4Kk154NZ.exe

description pid process target process

PID 2068 set thread context of 3828 2068 4Kk154NZ.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1012 2068 WerFault.exe 4Kk154NZ.exe

description	pid	process	target process
PID 2068 set thread context of 3828	2068	4Kk154NZ.exe	AppLaunch.exe

pid	pid_target	process	target process
1012	2068	WerFault.exe	4Kk154NZ.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

4Kk154NZ.exe

description	pid	process	target process
PID 2068 wrote to memory of 2112	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 2112	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 2112	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe
PID 2068 wrote to memory of 3828	2068	4Kk154NZ.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 344
2⤵
- Program crash
PID:1012

memory/3828-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3828-4-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/3828-5-0x000000000BB40000-0x000000000C03E000-memory.dmp

Filesize
5.0MB

Download
memory/3828-6-0x0000000009210000-0x00000000092A2000-memory.dmp

Filesize
584KB

Download
memory/3828-7-0x0000000006B30000-0x0000000006B40000-memory.dmp

Filesize
64KB

Download
memory/3828-8-0x000000000B650000-0x000000000B65A000-memory.dmp

Filesize
40KB

Download
memory/3828-9-0x000000000C650000-0x000000000CC56000-memory.dmp

Filesize
6.0MB

Download
memory/3828-10-0x000000000B8D0000-0x000000000B9DA000-memory.dmp

Filesize
1.0MB

Download
memory/3828-11-0x000000000B800000-0x000000000B812000-memory.dmp

Filesize
72KB

Download
memory/3828-12-0x000000000B860000-0x000000000B89E000-memory.dmp

Filesize
248KB

Download
memory/3828-13-0x000000000B9E0000-0x000000000BA2B000-memory.dmp

Filesize
300KB

Download
memory/3828-18-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/3828-19-0x0000000006B30000-0x0000000006B40000-memory.dmp

Filesize
64KB

Download