redline | 270587d93ddb654539ff7e5180ade9aa52ee2055f7220d71cf5db6768d96522a

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 02:42

Target

ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe
Size

1.1MB
MD5

a9c2c30c01843cf4d44de1c9d0c91cf2
SHA1

8b0bdad80d6559d2f610eb4fd1b86e9ab38b27d5
SHA256

ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a
SHA512

e3fee9bf946d3fbc6002ef78a86b60180ddecb17c4e45581e9f26e5375f0e25dd0c2588d4a2a60868a9430badbb5d6059f14389445a95c16c23a592681b28946
SSDEEP

12288:qq5l817Tb1M7eWQGI4SzGSC1lY1bOE7ZK6WLv721u0yfyAMxJeLHDw1:9allM7eWQGI4SyfTcZK6WAJaH8

Score

10^/10

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

194.169.175.234:27221

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2152-0-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4244	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	88
PID 5040 wrote to memory of 4244	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	88
PID 5040 wrote to memory of 4244	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	88
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89
PID 5040 wrote to memory of 2152	5040	ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe	89

C:\Users\Admin\AppData\Local\Temp\ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe
"C:\Users\Admin\AppData\Local\Temp\ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2152

memory/2152-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2152-1-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/2152-2-0x0000000007D50000-0x00000000082F4000-memory.dmp

Filesize
5.6MB

Download
memory/2152-3-0x0000000007840000-0x00000000078D2000-memory.dmp

Filesize
584KB

Download
memory/2152-4-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

Filesize
64KB

Download
memory/2152-5-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Filesize
40KB

Download
memory/2152-6-0x0000000008920000-0x0000000008F38000-memory.dmp

Filesize
6.1MB

Download
memory/2152-7-0x0000000007BE0000-0x0000000007CEA000-memory.dmp

Filesize
1.0MB

Download
memory/2152-8-0x0000000007AF0000-0x0000000007B02000-memory.dmp

Filesize
72KB

Download
memory/2152-9-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/2152-10-0x0000000007B50000-0x0000000007B8C000-memory.dmp

Filesize
240KB

Download
memory/2152-11-0x0000000007B90000-0x0000000007BDC000-memory.dmp

Filesize
304KB

Download
memory/2152-12-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

Filesize
64KB

Download