redline | 137773187f39738924c9f873b879d0a8432dd96b7e30f9681340599b08233ae8

Analysis

max time kernel
158s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 18:05

Target

NEAS.9271d4ca194ff3cfbf8bd13272166470.exe
Size

1.1MB
MD5

9271d4ca194ff3cfbf8bd13272166470
SHA1

e44b869c51b07fa5e98ffe05bc1124e83c60c839
SHA256

137773187f39738924c9f873b879d0a8432dd96b7e30f9681340599b08233ae8
SHA512

c4ca5955a983ca58c88171551c834c710ba2673c963a1978346d5d3c2108cd3449e7dd91cf1ef32da29000b99ed9ac80f069004fe4e2a829b6d2f200bd688273
SSDEEP

12288:T0xJ1c9psKtwW7IhuOXUPJuI85i8gTohuVoh3zGJYbn1bhzTm0:Te1c9psKtwW7m3iM5i8VnzQ0B

Score

10^/10

Family

redline

Botnet

breha

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2712-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2712-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2712-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2712-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2712-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	2872	WerFault.exe	27

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2712	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	30
PID 2872 wrote to memory of 2472	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	31
PID 2872 wrote to memory of 2472	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	31
PID 2872 wrote to memory of 2472	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	31
PID 2872 wrote to memory of 2472	2872	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.9271d4ca194ff3cfbf8bd13272166470.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9271d4ca194ff3cfbf8bd13272166470.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 52
  2⤵
  - Program crash
  PID:2472

memory/2712-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-10-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-11-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-12-0x00000000077C0000-0x0000000007800000-memory.dmp

Filesize
256KB

Download
memory/2712-13-0x00000000077C0000-0x0000000007800000-memory.dmp

Filesize
256KB

Download