redline | 4bd31a9a6e21f16e8a50eab7d37db2c325f693d2cdfcbb19ddcfaf5c7f2a5809

Analysis

max time kernel
140s
max time network
156s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 07:25

Target

NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe
Size

1.1MB
MD5

e4e5d77570b59bdf8aed3c5cf0baebd0
SHA1

6f96d165748ba94b8e9b222168b19f1ce47240e7
SHA256

4bd31a9a6e21f16e8a50eab7d37db2c325f693d2cdfcbb19ddcfaf5c7f2a5809
SHA512

8f9e2326847c0832952e31cc8d0d4fbd87323376a314a1570f6c5b442d1fca5e1bb513e8dfcd1984978842d098209141ca9cc00f6c5f7a4eb25852710eb19d2a
SSDEEP

12288:XsS8jmtwkTo7a0dmAesH+8/iqkpIZHS2f2eKgfu+CVC2ksvDdyqg:XtCmtwkTo7a0dPR5/iMZei4k5q

Score

10^/10

Family

redline

Botnet

grome

77.91.124.86:19084

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2120-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2120-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2120-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2120-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2120-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe

description pid process target process

PID 2104 set thread context of 2120 2104 NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe AppLaunch.exe

description	pid	process	target process
PID 2104 set thread context of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe

description	pid	process	target process
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 2104 wrote to memory of 2120	2104	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2120

memory/2120-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2120-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-10-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2120-11-0x0000000007190000-0x00000000071D0000-memory.dmp

Filesize
256KB

Download
memory/2120-12-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download