redline | 137773187f39738924c9f873b879d0a8432dd96b7e30f9681340599b08233ae8

Analysis

max time kernel
142s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 18:05

Target

NEAS.9271d4ca194ff3cfbf8bd13272166470.exe
Size

1.1MB
MD5

9271d4ca194ff3cfbf8bd13272166470
SHA1

e44b869c51b07fa5e98ffe05bc1124e83c60c839
SHA256

137773187f39738924c9f873b879d0a8432dd96b7e30f9681340599b08233ae8
SHA512

c4ca5955a983ca58c88171551c834c710ba2673c963a1978346d5d3c2108cd3449e7dd91cf1ef32da29000b99ed9ac80f069004fe4e2a829b6d2f200bd688273
SSDEEP

12288:T0xJ1c9psKtwW7IhuOXUPJuI85i8gTohuVoh3zGJYbn1bhzTm0:Te1c9psKtwW7m3iM5i8VnzQ0B

Score

10^/10

Family

redline

Botnet

breha

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4516-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4792 set thread context of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	4792	WerFault.exe	85

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89
PID 4792 wrote to memory of 4516	4792	NEAS.9271d4ca194ff3cfbf8bd13272166470.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.9271d4ca194ff3cfbf8bd13272166470.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9271d4ca194ff3cfbf8bd13272166470.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 240
  2⤵
  - Program crash
  PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4792 -ip 4792
1⤵
PID:4980

memory/4516-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-1-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4516-2-0x00000000079F0000-0x0000000007F94000-memory.dmp

Filesize
5.6MB

Download
memory/4516-3-0x0000000007540000-0x00000000075D2000-memory.dmp

Filesize
584KB

Download
memory/4516-4-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4516-5-0x0000000007720000-0x0000000007730000-memory.dmp

Filesize
64KB

Download
memory/4516-6-0x00000000078D0000-0x00000000078DA000-memory.dmp

Filesize
40KB

Download
memory/4516-7-0x0000000007720000-0x0000000007730000-memory.dmp

Filesize
64KB

Download
memory/4516-8-0x00000000086B0000-0x0000000008CC8000-memory.dmp

Filesize
6.1MB

Download
memory/4516-9-0x00000000081A0000-0x00000000082AA000-memory.dmp

Filesize
1.0MB

Download
memory/4516-10-0x00000000079B0000-0x00000000079C2000-memory.dmp

Filesize
72KB

Download
memory/4516-11-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/4516-12-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download