redline | 009e2c4ccbba2d91a056a0a48d6d6ea03714e76bffe37dc8f714d79a6b30e8e3

Analysis

max time kernel
177s
max time network
201s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 10:04

Target

j3638661.exe
Size

384KB
MD5

7c73ccffc9fd1bb94bc20c9047c8bba2
SHA1

2b336775b52f623d8e6dc21f5babd15edb8c42b2
SHA256

009e2c4ccbba2d91a056a0a48d6d6ea03714e76bffe37dc8f714d79a6b30e8e3
SHA512

380fc504d8117a75f80145bfd421b840d12843fb4b9761a8abaa9f8411260eddd26f0da8a3ed362f884f0a213f0e018ed353eaa66e2f6a9dcda990b3f3d46b13
SSDEEP

12288:7TRweSHxzyZg09spUfzMJZVk95wWW6ruUF4S:7eejZgrsW6rv2

Score

10^/10

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 2716	2704	j3638661.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2704	WerFault.exe	13

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2716	2704	j3638661.exe	29
PID 2704 wrote to memory of 2872	2704	j3638661.exe	30
PID 2704 wrote to memory of 2872	2704	j3638661.exe	30
PID 2704 wrote to memory of 2872	2704	j3638661.exe	30
PID 2704 wrote to memory of 2872	2704	j3638661.exe	30

C:\Users\Admin\AppData\Local\Temp\j3638661.exe
"C:\Users\Admin\AppData\Local\Temp\j3638661.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 92
  2⤵
  - Program crash
  PID:2872

memory/2716-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2716-10-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2716-11-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2716-12-0x0000000000620000-0x0000000000660000-memory.dmp

Filesize
256KB

Download
memory/2716-13-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2716-14-0x0000000000620000-0x0000000000660000-memory.dmp

Filesize
256KB

Download