redline | 9993005debbecfdec12b17824563772d25094cd5893ae9c8378a770450d8e4e4

Analysis

max time kernel
291s
max time network
297s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 05:06

Target

4LH589FE.exe
Size

459KB
MD5

5b250fb771820b54b7998b68630c0bd9
SHA1

f401b42cb0a2530ec2e7c8f736aa633fe9eadae0
SHA256

9993005debbecfdec12b17824563772d25094cd5893ae9c8378a770450d8e4e4
SHA512

77f15b5f97e572b724ea74d6a46fbb57ac04420fd4e09700f3ffddc14cb70a3fb2f3b2cbb7da602ba88778c24dc7044332eec8bb74a9aa8975ec96b86c409122
SSDEEP

6144:+fuhebDPM4jjdpvIN8fp7z5BAOCIb5u5ErTmrKfPZ+WHrwchzpY6f8iKX0X:+fuODPjjb/4U5kErjfnH91pYE8iKkX

Score

10^/10

Family

redline

Botnet

magia

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2404-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2404-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2404-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2404-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2404-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 2404	1008	4LH589FE.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	1008	WerFault.exe	28

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2404	1008	4LH589FE.exe	30
PID 1008 wrote to memory of 2676	1008	4LH589FE.exe	31
PID 1008 wrote to memory of 2676	1008	4LH589FE.exe	31
PID 1008 wrote to memory of 2676	1008	4LH589FE.exe	31
PID 1008 wrote to memory of 2676	1008	4LH589FE.exe	31

C:\Users\Admin\AppData\Local\Temp\4LH589FE.exe
"C:\Users\Admin\AppData\Local\Temp\4LH589FE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 136
  2⤵
  - Program crash
  PID:2676

memory/2404-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2404-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-10-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2404-11-0x00000000073C0000-0x0000000007400000-memory.dmp

Filesize
256KB

Download
memory/2404-12-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2404-13-0x00000000073C0000-0x0000000007400000-memory.dmp

Filesize
256KB

Download