redline | 009e2c4ccbba2d91a056a0a48d6d6ea03714e76bffe37dc8f714d79a6b30e8e3

Analysis

max time kernel
166s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 10:04

Target

j3638661.exe
Size

384KB
MD5

7c73ccffc9fd1bb94bc20c9047c8bba2
SHA1

2b336775b52f623d8e6dc21f5babd15edb8c42b2
SHA256

009e2c4ccbba2d91a056a0a48d6d6ea03714e76bffe37dc8f714d79a6b30e8e3
SHA512

380fc504d8117a75f80145bfd421b840d12843fb4b9761a8abaa9f8411260eddd26f0da8a3ed362f884f0a213f0e018ed353eaa66e2f6a9dcda990b3f3d46b13
SSDEEP

12288:7TRweSHxzyZg09spUfzMJZVk95wWW6ruUF4S:7eejZgrsW6rv2

Score

10^/10

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3824 set thread context of 860	3824	j3638661.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	3824	WerFault.exe	83

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4544	3824	j3638661.exe	86
PID 3824 wrote to memory of 4544	3824	j3638661.exe	86
PID 3824 wrote to memory of 4544	3824	j3638661.exe	86
PID 3824 wrote to memory of 1476	3824	j3638661.exe	87
PID 3824 wrote to memory of 1476	3824	j3638661.exe	87
PID 3824 wrote to memory of 1476	3824	j3638661.exe	87
PID 3824 wrote to memory of 1300	3824	j3638661.exe	88
PID 3824 wrote to memory of 1300	3824	j3638661.exe	88
PID 3824 wrote to memory of 1300	3824	j3638661.exe	88
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89
PID 3824 wrote to memory of 860	3824	j3638661.exe	89

C:\Users\Admin\AppData\Local\Temp\j3638661.exe
"C:\Users\Admin\AppData\Local\Temp\j3638661.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 320
  2⤵
  - Program crash
  PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3824 -ip 3824
1⤵
PID:4508

memory/860-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/860-1-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/860-2-0x0000000002A50000-0x0000000002A56000-memory.dmp

Filesize
24KB

Download
memory/860-3-0x0000000005850000-0x0000000005E68000-memory.dmp

Filesize
6.1MB

Download
memory/860-4-0x0000000005340000-0x000000000544A000-memory.dmp

Filesize
1.0MB

Download
memory/860-6-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/860-5-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/860-7-0x0000000005290000-0x00000000052CC000-memory.dmp

Filesize
240KB

Download
memory/860-8-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/860-9-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/860-10-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download