redline | 5ed69e5d911b8e81da107ec15d7989c44edca8689517970d84354a9db4b98653

Analysis

max time kernel
290s
max time network
304s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
03/11/2023, 05:07

Target

4se182zn.exe
Size

1.1MB
MD5

a3d9d2941072762f79cd51e9033cfe7c
SHA1

2d8b476eed489e9b412bf1a2fe0737bc975c9f4d
SHA256

5ed69e5d911b8e81da107ec15d7989c44edca8689517970d84354a9db4b98653
SHA512

fdb95bb2023f1502903e20e49690a0ab5d76a2c4db82b28a26f09196255441e8189329d963720e163f2ac65efde1eaa8d57cf53cf5edac48782c60509831d160
SSDEEP

12288:XrB5IZ2nfkPenJ2U7vq/wMR5Sunrv90pxf1xh9uuSVKhAjviJeP3xnto:vg2fkPenJ2U7vqvbnrvwF0gqht

Score

10^/10

Family

redline

Botnet

plost

77.91.124.86:19084

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1576-0-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 1576	4496	4se182zn.exe	70

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70
PID 4496 wrote to memory of 1576	4496	4se182zn.exe	70

C:\Users\Admin\AppData\Local\Temp\4se182zn.exe
"C:\Users\Admin\AppData\Local\Temp\4se182zn.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1576

memory/1576-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-4-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1576-5-0x000000000B6F0000-0x000000000BBEE000-memory.dmp

Filesize
5.0MB

Download
memory/1576-6-0x000000000B1F0000-0x000000000B282000-memory.dmp

Filesize
584KB

Download
memory/1576-7-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download
memory/1576-8-0x00000000067B0000-0x00000000067BA000-memory.dmp

Filesize
40KB

Download
memory/1576-9-0x000000000C200000-0x000000000C806000-memory.dmp

Filesize
6.0MB

Download
memory/1576-10-0x000000000BBF0000-0x000000000BCFA000-memory.dmp

Filesize
1.0MB

Download
memory/1576-11-0x000000000B550000-0x000000000B562000-memory.dmp

Filesize
72KB

Download
memory/1576-12-0x000000000B5B0000-0x000000000B5EE000-memory.dmp

Filesize
248KB

Download
memory/1576-13-0x000000000B5F0000-0x000000000B63B000-memory.dmp

Filesize
300KB

Download
memory/1576-18-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/1576-19-0x000000000B420000-0x000000000B430000-memory.dmp

Filesize
64KB

Download