redline | 73e7e98d6e9c937a3fc99c48fa546c17620d19825c1c89ae57bc26c141f97e37

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 17:13

Target

j7565833.exe
Size

405KB
MD5

0debc958242aa414b9092b9a5362c03d
SHA1

11bcb3ecc9211f3ec367fbbcfe63000ec22d67b7
SHA256

73e7e98d6e9c937a3fc99c48fa546c17620d19825c1c89ae57bc26c141f97e37
SHA512

42f15e9247171c4a9444593fbdaf51f16627dab2bc7e651824addbc6dff8817d437b0ea400f151d5be18c18bd51060a6744e8dcb56364331b0a85ed359c84c2f
SSDEEP

6144:uE40pm39jOBs+DfT8i1O9DAOfBQu1S1lNZlM3UmjlRLE8kEmJxQ8G8/:uIQ39y6jNXt1SbNI3UmjlBEEmi8/

Score

10^/10

Family

redline

Botnet

monik

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2024	2176	j7565833.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83
PID 2176 wrote to memory of 2024	2176	j7565833.exe	83

C:\Users\Admin\AppData\Local\Temp\j7565833.exe
"C:\Users\Admin\AppData\Local\Temp\j7565833.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2024

memory/2024-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2024-1-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/2024-2-0x00000000031C0000-0x00000000031C6000-memory.dmp

Filesize
24KB

Download
memory/2024-3-0x000000000B2D0000-0x000000000B8E8000-memory.dmp

Filesize
6.1MB

Download
memory/2024-4-0x000000000ADF0000-0x000000000AEFA000-memory.dmp

Filesize
1.0MB

Download
memory/2024-5-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/2024-6-0x000000000AD30000-0x000000000AD42000-memory.dmp

Filesize
72KB

Download
memory/2024-7-0x000000000AD90000-0x000000000ADCC000-memory.dmp

Filesize
240KB

Download
memory/2024-8-0x000000000AF00000-0x000000000AF4C000-memory.dmp

Filesize
304KB

Download
memory/2024-9-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/2024-10-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download