redline | 410b994d456cc36e464a31ba13c53bd87e4f1434846f764c30e3359abdb18207

Analysis

max time kernel
137s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 20:34

Target

j1327061.exe
Size

383KB
MD5

53845cd00f9a94441fdfd22a0bf3cb8c
SHA1

35e65923d294e22153e46b486c14f13eb67d3484
SHA256

410b994d456cc36e464a31ba13c53bd87e4f1434846f764c30e3359abdb18207
SHA512

ef1df60652606897d49d1388d928e52b945649a97fe323e5ffaa052dfb6f562660eed33b8159d1ce68790be1cf4bba50d32c4d1feccec9eca1088e37b9014b43
SSDEEP

6144:fB46fuYXChoQTjlFgLuCY1dRuAOcMz6XjTLT8Kv51Z9vw8y0:fWYzXChdTbv1buB+XXRv51Z9vw8y

Score

10^/10

Family

redline

Botnet

kurda

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2216	1720	j1327061.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	1720	WerFault.exe	27

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2184	1720	j1327061.exe	28
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 2216	1720	j1327061.exe	29
PID 1720 wrote to memory of 1236	1720	j1327061.exe	30
PID 1720 wrote to memory of 1236	1720	j1327061.exe	30
PID 1720 wrote to memory of 1236	1720	j1327061.exe	30
PID 1720 wrote to memory of 1236	1720	j1327061.exe	30

C:\Users\Admin\AppData\Local\Temp\j1327061.exe
"C:\Users\Admin\AppData\Local\Temp\j1327061.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 60
  2⤵
  - Program crash
  PID:1236

memory/2216-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2216-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2216-10-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2216-11-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2216-12-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download
memory/2216-13-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2216-14-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download