redline | 55077c3cb4d778f7d242568ba6912e7e259d11a53f548a60993394e74b39226d

Analysis

max time kernel
138s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 03:27

Target

NEAS.b847d5f1861026f707700bb663668f10_JC.exe
Size

1.1MB
MD5

b847d5f1861026f707700bb663668f10
SHA1

925ea7cff66616bc61536cf397c5a183b92eb1fa
SHA256

55077c3cb4d778f7d242568ba6912e7e259d11a53f548a60993394e74b39226d
SHA512

32ca44bffa9151f0b7a30e05cc6bcf716df234f0994aec73fc8f416d749fa198a52b275de41dd2d9448da7c7c0f0af74197994e7045e84af05a47f80d8ed0507
SSDEEP

12288:fqPKKEZLL3GvJYfS8RRgzFp+BXOMsZKO5VSiVufyZywvWIc93:cEd3GvJYfS8R+2oHZKO5lvs

Score

10^/10

Family

redline

Botnet

grome

77.91.124.86:19084

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1176-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.b847d5f1861026f707700bb663668f10_JC.exe

description pid process target process

PID 1324 set thread context of 1176 1324 NEAS.b847d5f1861026f707700bb663668f10_JC.exe AppLaunch.exe

description	pid	process	target process
PID 1324 set thread context of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NEAS.b847d5f1861026f707700bb663668f10_JC.exe

description	pid	process	target process
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe
PID 1324 wrote to memory of 1176	1324	NEAS.b847d5f1861026f707700bb663668f10_JC.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1176

memory/1176-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1176-1-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/1176-2-0x0000000008080000-0x0000000008624000-memory.dmp

Filesize
5.6MB

Download
memory/1176-3-0x0000000007BD0000-0x0000000007C62000-memory.dmp

Filesize
584KB

Download
memory/1176-4-0x0000000007DE0000-0x0000000007DF0000-memory.dmp

Filesize
64KB

Download
memory/1176-5-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Filesize
40KB

Download
memory/1176-6-0x0000000008C50000-0x0000000009268000-memory.dmp

Filesize
6.1MB

Download
memory/1176-7-0x0000000008630000-0x000000000873A000-memory.dmp

Filesize
1.0MB

Download
memory/1176-8-0x0000000007D70000-0x0000000007D82000-memory.dmp

Filesize
72KB

Download
memory/1176-9-0x0000000007EE0000-0x0000000007F1C000-memory.dmp

Filesize
240KB

Download
memory/1176-10-0x0000000007F20000-0x0000000007F6C000-memory.dmp

Filesize
304KB

Download
memory/1176-11-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/1176-12-0x0000000007DE0000-0x0000000007DF0000-memory.dmp

Filesize
64KB

Download