redline | 96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911

Analysis

max time kernel
138s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 06:24

Target

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe
Size

380KB
MD5

96c64a07dd766bd28df04bc6279d234d
SHA1

24d7570031a0303c4854051893a11165a10f3059
SHA256

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911
SHA512

ddc9e0d5510aa52a3fb6b6ddd723fa64a8c214a058abf0d3e6f3e3d3548b170b19d30673ef16ed6e87b6806ce535c9607f24225a7bd9b3bb06131f06771669da
SSDEEP

6144:iNCWVTxu4YKkt4HDw93MmAOTRoo4mYxWpjuNN1zzjIkeN3viKC:iNLxu4YKLmXbNYxWYNN1zzjmiKC

Score

10^/10

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

description	pid	process	target process
PID 3232 set thread context of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3360 3232 WerFault.exe 96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

pid	pid_target	process	target process
3360	3232	WerFault.exe	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe

description	pid	process	target process
PID 3232 wrote to memory of 444	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 444	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 444	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe
PID 3232 wrote to memory of 4440	3232	96692550fc4f3d468a0d8ad1286cd72d28ccb8fb5f776c62c07cede58da03911_JC.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 368
2⤵
- Program crash
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3232 -ip 3232
1⤵
PID:3684

memory/4440-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4440-1-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4440-2-0x0000000001750000-0x0000000001756000-memory.dmp

Filesize
24KB

Download
memory/4440-3-0x0000000005C10000-0x0000000006228000-memory.dmp

Filesize
6.1MB

Download
memory/4440-4-0x0000000005700000-0x000000000580A000-memory.dmp

Filesize
1.0MB

Download
memory/4440-5-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/4440-6-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/4440-7-0x0000000005570000-0x00000000055AC000-memory.dmp

Filesize
240KB

Download
memory/4440-8-0x00000000055F0000-0x000000000563C000-memory.dmp

Filesize
304KB

Download
memory/4440-9-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4440-10-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download