redline | 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a

Analysis

max time kernel
204s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:35

Target

70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe
Size

382KB
MD5

91e3081c35f8fbc3c5d82a127905ea3d
SHA1

c33f12ff653b4b2817b267a2eb42a36ed0f80027
SHA256

70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a
SHA512

485242ff08e9ae43f2399368b2faccc3218200bbfe4e6e969196b4590f034e3c1baf2f00d4c3d24d4c7acbfa8f82c2363030ae4e2584a6b462bb904426cc017a
SSDEEP

6144:QnAe2Way5hWybjlV1VDWiZuAOEp9hlh1Jm/dd37BkslF6Lw8y:QAl1y5hNbDlu4lh1cFd37BZ2w8y

Score

10^/10

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

51.38.95.107:42494

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3768 set thread context of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4348	3768	WerFault.exe	47

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84
PID 3768 wrote to memory of 5040	3768	70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe
"C:\Users\Admin\AppData\Local\Temp\70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 260
  2⤵
  - Program crash
  PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3768 -ip 3768
1⤵
PID:4568

memory/5040-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5040-1-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/5040-2-0x0000000000E10000-0x0000000000E16000-memory.dmp

Filesize
24KB

Download
memory/5040-3-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/5040-4-0x0000000005580000-0x0000000005B98000-memory.dmp

Filesize
6.1MB

Download
memory/5040-5-0x00000000050E0000-0x00000000051EA000-memory.dmp

Filesize
1.0MB

Download
memory/5040-6-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/5040-7-0x00000000026E0000-0x00000000026F0000-memory.dmp

Filesize
64KB

Download
memory/5040-8-0x0000000005080000-0x00000000050BC000-memory.dmp

Filesize
240KB

Download
memory/5040-9-0x00000000026E0000-0x00000000026F0000-memory.dmp

Filesize
64KB

Download
memory/5040-10-0x00000000051F0000-0x000000000523C000-memory.dmp

Filesize
304KB

Download