redline | 8f469b226ef2caa9193de6fc5bfc35d51d4b9d28e907a13442491167d2686654

Analysis

max time kernel
145s
max time network
171s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
28/10/2023, 20:16

Target

NEAS.e224785c3c825e3c45cf59cac9d62d00.exe
Size

1.1MB
MD5

e224785c3c825e3c45cf59cac9d62d00
SHA1

e27cdc82e8955c8926523d3f2669f485a4d69670
SHA256

8f469b226ef2caa9193de6fc5bfc35d51d4b9d28e907a13442491167d2686654
SHA512

70822471a415dc68ab81cae7b4dbdf92bf5436bc424573bb75bd6178cd7ac5f94212000894ec862720003a03b1eb562556e24a161488f7c0447ac2599f6587e4
SSDEEP

24576:5SILs3Gv5W1TxGQcQkX4OkHpzUw2j4mukOZWh5MBq:5tBWTxGQcQi4OnwWIZWP+

Score

10^/10

Family

redline

Botnet

grome

77.91.124.86:19084

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2784-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2784-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2784-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2784-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2784-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2784-13-0x0000000002540000-0x0000000002580000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28
PID 2228 wrote to memory of 2784	2228	NEAS.e224785c3c825e3c45cf59cac9d62d00.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.e224785c3c825e3c45cf59cac9d62d00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e224785c3c825e3c45cf59cac9d62d00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2784

memory/2784-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2784-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-10-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2784-11-0x0000000002540000-0x0000000002580000-memory.dmp

Filesize
256KB

Download
memory/2784-12-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2784-13-0x0000000002540000-0x0000000002580000-memory.dmp

Filesize
256KB

Download