redline | 42df844a60c2121d9e334a9fed2b21653adba1766f4a552e747d41917e12fa78

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 18:53

Target

file.exe
Size

405KB
MD5

81e1ad93faa9c9eb87c1ca190e78df54
SHA1

77df978e6a2400d4831a07ba23d10914c101f611
SHA256

42df844a60c2121d9e334a9fed2b21653adba1766f4a552e747d41917e12fa78
SHA512

5b4505d7bd4bd475b89db43f2fcf30085215dc000610e07d951c0c83055d1f47e41f5601cbb539f2bcad5b768b33fa5fa15a70788818e8ba5fe1ed4d319a533f
SSDEEP

6144:/7vJm09zORs+z/TMify9DAOEoQHavKkZo7bNHu/E+iy2bHRXova4+br333csGguJ:/bw09CK5Nr+HuM+eRuaosGgum85

Score

10^/10

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

51.38.95.107:42494

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 1776	4492	file.exe	85

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85
PID 4492 wrote to memory of 1776	4492	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1776

memory/1776-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1776-1-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/1776-2-0x00000000027C0000-0x00000000027C6000-memory.dmp

Filesize
24KB

Download
memory/1776-3-0x00000000055A0000-0x0000000005BB8000-memory.dmp

Filesize
6.1MB

Download
memory/1776-4-0x0000000005090000-0x000000000519A000-memory.dmp

Filesize
1.0MB

Download
memory/1776-5-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/1776-6-0x0000000004F80000-0x0000000004F92000-memory.dmp

Filesize
72KB

Download
memory/1776-7-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/1776-8-0x0000000005020000-0x000000000506C000-memory.dmp

Filesize
304KB

Download
memory/1776-9-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/1776-10-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download