redline | 96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911

General

Target

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe
Size

380KB
MD5

96c64a07dd766bd28df04bc6279d234d
SHA1

24d7570031a0303c4854051893a11165a10f3059
SHA256

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911
SHA512

ddc9e0d5510aa52a3fb6b6ddd723fa64a8c214a058abf0d3e6f3e3d3548b170b19d30673ef16ed6e87b6806ce535c9607f24225a7bd9b3bb06131f06771669da
SSDEEP

6144:iNCWVTxu4YKkt4HDw93MmAOTRoo4mYxWpjuNN1zzjIkeN3viKC:iNLxu4YKLmXbNYxWYNN1zzjmiKC

Score

10^/10

redline gruha infostealer

Malware Config

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

description	pid	process	target process
PID 1692 set thread context of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2640 1692 WerFault.exe 96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

pid	pid_target	process	target process
2640	1692	WerFault.exe	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

description	pid	process	target process
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 1848	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 3036	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 1692 wrote to memory of 2640	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	WerFault.exe
PID 1692 wrote to memory of 2640	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	WerFault.exe
PID 1692 wrote to memory of 2640	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	WerFault.exe
PID 1692 wrote to memory of 2640	1692	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe
"C:\Users\Admin\AppData\Local\Temp\96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 128
  2⤵
  - Program crash
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3036-11-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/3036-10-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-12-0x0000000002530000-0x0000000002570000-memory.dmp

Filesize
256KB

Download
memory/3036-13-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-14-0x0000000002530000-0x0000000002570000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing