redline | 706224d01959812281290adc2f43521e5d38d0c3a556b381b8cbac2c2aa90e82

Analysis

max time kernel
177s
max time network
189s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:46

Target

file.exe
Size

396KB
MD5

fa15aa45d6e71de5927a75d60bd70f7b
SHA1

e8bafb47eb22cc18d7695625da0937ac3c2d9036
SHA256

706224d01959812281290adc2f43521e5d38d0c3a556b381b8cbac2c2aa90e82
SHA512

412cddc921e1d0402409c82786404df81078bea2af48157500d3b2946b51acfb79a8b29136f9ba64d4e3c0b69d9f7c964e57cbbf849c79c7f288f4603f369e4c
SSDEEP

6144:BLErViSWAs3WHexAVklAOaF2VaAg6U6J7k8edK/EGoPGCc:BL0iSWLT0+K6U60dK/EXGCc

Score

10^/10

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

146.59.10.173:45035

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 1720	2852	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	2852	WerFault.exe	8

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1720	2852	file.exe	28
PID 2852 wrote to memory of 1700	2852	file.exe	29
PID 2852 wrote to memory of 1700	2852	file.exe	29
PID 2852 wrote to memory of 1700	2852	file.exe	29
PID 2852 wrote to memory of 1700	2852	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 92
  2⤵
  - Program crash
  PID:1700

memory/1720-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1720-10-0x0000000073D80000-0x000000007446E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-11-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1720-12-0x0000000000FA0000-0x0000000000FE0000-memory.dmp

Filesize
256KB

Download
memory/1720-13-0x0000000073D80000-0x000000007446E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-14-0x0000000000FA0000-0x0000000000FE0000-memory.dmp

Filesize
256KB

Download