redline | 73e7e98d6e9c937a3fc99c48fa546c17620d19825c1c89ae57bc26c141f97e37

Analysis

max time kernel
137s
max time network
149s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 17:13

Target

j7565833.exe
Size

405KB
MD5

0debc958242aa414b9092b9a5362c03d
SHA1

11bcb3ecc9211f3ec367fbbcfe63000ec22d67b7
SHA256

73e7e98d6e9c937a3fc99c48fa546c17620d19825c1c89ae57bc26c141f97e37
SHA512

42f15e9247171c4a9444593fbdaf51f16627dab2bc7e651824addbc6dff8817d437b0ea400f151d5be18c18bd51060a6744e8dcb56364331b0a85ed359c84c2f
SSDEEP

6144:uE40pm39jOBs+DfT8i1O9DAOfBQu1S1lNZlM3UmjlRLE8kEmJxQ8G8/:uIQ39y6jNXt1SbNI3UmjlBEEmi8/

Score

10^/10

Family

redline

Botnet

monik

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 2372	2816	j7565833.exe	29

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2700	2816	j7565833.exe	28
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29
PID 2816 wrote to memory of 2372	2816	j7565833.exe	29

C:\Users\Admin\AppData\Local\Temp\j7565833.exe
"C:\Users\Admin\AppData\Local\Temp\j7565833.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2372

memory/2372-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2372-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-7-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2372-10-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-11-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2372-12-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download
memory/2372-13-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-14-0x0000000000440000-0x0000000000480000-memory.dmp

Filesize
256KB

Download