redline | 639722b6340d2aefe6bec6cf9a2e5d47f69e46d794a9336bd9fde3f5c2c357f0

Analysis

max time kernel
177s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 17:13

Target

j8930172.exe
Size

405KB
MD5

15e6ccca9ec2cdb3f98d29939293afa6
SHA1

f921d6e690c9b154efa1ec37baa24526ef79f12f
SHA256

639722b6340d2aefe6bec6cf9a2e5d47f69e46d794a9336bd9fde3f5c2c357f0
SHA512

853640befc288663f71148ec880b4c0338a0b24cd42b92512671284e79588d8f1df883b8ddc187813b4c56c9efd042bb51c528176b3a2ef58e085b36e55120ba
SSDEEP

6144:G0vJm09zORs+z/TMify9DAOVoQDmQ9WD+JcbK+UgLqc+t1FZX8/:Gcw09CK5N4t8Js5MF8/

Score

10^/10

Family

redline

Botnet

monik

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 4164	3848	j8930172.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84
PID 3848 wrote to memory of 4164	3848	j8930172.exe	84

C:\Users\Admin\AppData\Local\Temp\j8930172.exe
"C:\Users\Admin\AppData\Local\Temp\j8930172.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4164

memory/4164-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4164-1-0x0000000074A40000-0x00000000751F0000-memory.dmp

Filesize
7.7MB

Download
memory/4164-2-0x0000000002510000-0x0000000002516000-memory.dmp

Filesize
24KB

Download
memory/4164-3-0x0000000074A40000-0x00000000751F0000-memory.dmp

Filesize
7.7MB

Download
memory/4164-4-0x000000000A4B0000-0x000000000AAC8000-memory.dmp

Filesize
6.1MB

Download
memory/4164-5-0x0000000009FF0000-0x000000000A0FA000-memory.dmp

Filesize
1.0MB

Download
memory/4164-6-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download
memory/4164-7-0x0000000009F30000-0x0000000009F42000-memory.dmp

Filesize
72KB

Download
memory/4164-8-0x0000000009F90000-0x0000000009FCC000-memory.dmp

Filesize
240KB

Download
memory/4164-9-0x000000000A100000-0x000000000A14C000-memory.dmp

Filesize
304KB

Download
memory/4164-10-0x0000000002520000-0x0000000002530000-memory.dmp

Filesize
64KB

Download