redline | 6e6b20f965fdd9d0836ab01a2f1c2416930f32a8418f2eb99cf8a63fc3dd02ec

Analysis

max time kernel
137s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 10:45

Target

NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe
Size

1.2MB
MD5

23dfdf77e8606a7e40d56ebf332cd110
SHA1

8adcd94bbd07cfea07416fbcce5b58e6b557bce3
SHA256

6e6b20f965fdd9d0836ab01a2f1c2416930f32a8418f2eb99cf8a63fc3dd02ec
SHA512

0de3e43c032a15188080504867eea8ace4498342a4b9cdcf248c4e5e759389d10f18afe09f7c2de147bf687628211d400933b08b674c120ee350143fdde8b52f
SSDEEP

12288:dbc4HI2dAilhotf+BVv/rqlHYBPXVqrbmxoRj3cs5R7Ju9cdTrukWZPzL:24o2dAiItf+BVHjcIoRj3csPOkWZP

Score

10^/10

Family

redline

Botnet

grome

77.91.124.86:19084

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/816-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe

description pid process target process

PID 924 set thread context of 816 924 NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3584 924 WerFault.exe NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe

description	pid	process	target process
PID 924 set thread context of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe

pid	pid_target	process	target process
3584	924	WerFault.exe	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe

description	pid	process	target process
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe
PID 924 wrote to memory of 816	924	NEAS.23dfdf77e8606a7e40d56ebf332cd110_JC.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 316
2⤵
- Program crash
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 924 -ip 924
1⤵
PID:4268

memory/816-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/816-1-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/816-2-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/816-3-0x0000000007A50000-0x0000000007FF4000-memory.dmp

Filesize
5.6MB

Download
memory/816-4-0x0000000007540000-0x00000000075D2000-memory.dmp

Filesize
584KB

Download
memory/816-5-0x00000000077C0000-0x00000000077D0000-memory.dmp

Filesize
64KB

Download
memory/816-6-0x0000000007530000-0x000000000753A000-memory.dmp

Filesize
40KB

Download
memory/816-7-0x0000000008620000-0x0000000008C38000-memory.dmp

Filesize
6.1MB

Download
memory/816-8-0x00000000078E0000-0x00000000079EA000-memory.dmp

Filesize
1.0MB

Download
memory/816-9-0x00000000077A0000-0x00000000077B2000-memory.dmp

Filesize
72KB

Download
memory/816-10-0x0000000007810000-0x000000000784C000-memory.dmp

Filesize
240KB

Download
memory/816-11-0x0000000007850000-0x000000000789C000-memory.dmp

Filesize
304KB

Download
memory/816-12-0x00000000077C0000-0x00000000077D0000-memory.dmp

Filesize
64KB

Download