redline | 410b994d456cc36e464a31ba13c53bd87e4f1434846f764c30e3359abdb18207

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 20:34

Target

j1327061.exe
Size

383KB
MD5

53845cd00f9a94441fdfd22a0bf3cb8c
SHA1

35e65923d294e22153e46b486c14f13eb67d3484
SHA256

410b994d456cc36e464a31ba13c53bd87e4f1434846f764c30e3359abdb18207
SHA512

ef1df60652606897d49d1388d928e52b945649a97fe323e5ffaa052dfb6f562660eed33b8159d1ce68790be1cf4bba50d32c4d1feccec9eca1088e37b9014b43
SSDEEP

6144:fB46fuYXChoQTjlFgLuCY1dRuAOcMz6XjTLT8Kv51Z9vw8y0:fWYzXChdTbv1buB+XXRv51Z9vw8y

Score

10^/10

Family

redline

Botnet

kurda

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 4380	5092	j1327061.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4124	5092	WerFault.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86
PID 5092 wrote to memory of 4380	5092	j1327061.exe	86

C:\Users\Admin\AppData\Local\Temp\j1327061.exe
"C:\Users\Admin\AppData\Local\Temp\j1327061.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 256
  2⤵
  - Program crash
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5092 -ip 5092
1⤵
PID:2056

memory/4380-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4380-1-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/4380-2-0x0000000000FB0000-0x0000000000FB6000-memory.dmp

Filesize
24KB

Download
memory/4380-3-0x0000000074B90000-0x0000000075340000-memory.dmp

Filesize
7.7MB

Download
memory/4380-4-0x00000000054C0000-0x0000000005AD8000-memory.dmp

Filesize
6.1MB

Download
memory/4380-5-0x0000000005230000-0x000000000533A000-memory.dmp

Filesize
1.0MB

Download
memory/4380-7-0x0000000005160000-0x0000000005172000-memory.dmp

Filesize
72KB

Download
memory/4380-6-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/4380-8-0x00000000051C0000-0x00000000051FC000-memory.dmp

Filesize
240KB

Download
memory/4380-9-0x0000000005340000-0x000000000538C000-memory.dmp

Filesize
304KB

Download
memory/4380-10-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download