redline | 9993005debbecfdec12b17824563772d25094cd5893ae9c8378a770450d8e4e4

Analysis

max time kernel
291s
max time network
300s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
10-10-2023 05:06

Target

4LH589FE.exe
Size

459KB
MD5

5b250fb771820b54b7998b68630c0bd9
SHA1

f401b42cb0a2530ec2e7c8f736aa633fe9eadae0
SHA256

9993005debbecfdec12b17824563772d25094cd5893ae9c8378a770450d8e4e4
SHA512

77f15b5f97e572b724ea74d6a46fbb57ac04420fd4e09700f3ffddc14cb70a3fb2f3b2cbb7da602ba88778c24dc7044332eec8bb74a9aa8975ec96b86c409122
SSDEEP

6144:+fuhebDPM4jjdpvIN8fp7z5BAOCIb5u5ErTmrKfPZ+WHrwchzpY6f8iKX0X:+fuODPjjb/4U5kErjfnH91pYE8iKkX

Score

10^/10

Family

redline

Botnet

magia

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1060-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 1060	1020	4LH589FE.exe	73

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4380	1020	WerFault.exe	70

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2520	1020	4LH589FE.exe	72
PID 1020 wrote to memory of 2520	1020	4LH589FE.exe	72
PID 1020 wrote to memory of 2520	1020	4LH589FE.exe	72
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73
PID 1020 wrote to memory of 1060	1020	4LH589FE.exe	73

C:\Users\Admin\AppData\Local\Temp\4LH589FE.exe
"C:\Users\Admin\AppData\Local\Temp\4LH589FE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 148
  2⤵
  - Program crash
  PID:4380

memory/1060-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-4-0x0000000073570000-0x0000000073C5E000-memory.dmp

Filesize
6.9MB

Download
memory/1060-5-0x000000000BCD0000-0x000000000C1CE000-memory.dmp

Filesize
5.0MB

Download
memory/1060-6-0x000000000B8B0000-0x000000000B942000-memory.dmp

Filesize
584KB

Download
memory/1060-7-0x000000000BB30000-0x000000000BB40000-memory.dmp

Filesize
64KB

Download
memory/1060-8-0x000000000B8A0000-0x000000000B8AA000-memory.dmp

Filesize
40KB

Download
memory/1060-9-0x000000000C7E0000-0x000000000CDE6000-memory.dmp

Filesize
6.0MB

Download
memory/1060-10-0x000000000C1D0000-0x000000000C2DA000-memory.dmp

Filesize
1.0MB

Download
memory/1060-11-0x000000000BAE0000-0x000000000BAF2000-memory.dmp

Filesize
72KB

Download
memory/1060-12-0x000000000BB80000-0x000000000BBBE000-memory.dmp

Filesize
248KB

Download
memory/1060-13-0x000000000BBC0000-0x000000000BC0B000-memory.dmp

Filesize
300KB

Download
memory/1060-18-0x0000000073570000-0x0000000073C5E000-memory.dmp

Filesize
6.9MB

Download
memory/1060-19-0x000000000BB30000-0x000000000BB40000-memory.dmp

Filesize
64KB

Download