redline | 4bd31a9a6e21f16e8a50eab7d37db2c325f693d2cdfcbb19ddcfaf5c7f2a5809

General

Target

NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe
Size

1.1MB
MD5

e4e5d77570b59bdf8aed3c5cf0baebd0
SHA1

6f96d165748ba94b8e9b222168b19f1ce47240e7
SHA256

4bd31a9a6e21f16e8a50eab7d37db2c325f693d2cdfcbb19ddcfaf5c7f2a5809
SHA512

8f9e2326847c0832952e31cc8d0d4fbd87323376a314a1570f6c5b442d1fca5e1bb513e8dfcd1984978842d098209141ca9cc00f6c5f7a4eb25852710eb19d2a
SSDEEP

12288:XsS8jmtwkTo7a0dmAesH+8/iqkpIZHS2f2eKgfu+CVC2ksvDdyqg:XtCmtwkTo7a0dPR5/iMZei4k5q

Score

10^/10

redline grome infostealer

Malware Config

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/712-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe

description pid process target process

PID 3644 set thread context of 712 3644 NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe AppLaunch.exe

description	pid	process	target process
PID 3644 set thread context of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe

description	pid	process	target process
PID 3644 wrote to memory of 3360	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3360	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3360	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 4988	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 4988	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 4988	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3732	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3732	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3732	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 2260	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 2260	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 2260	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 2616	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 2616	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 2616	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3904	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3904	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 3904	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe
PID 3644 wrote to memory of 712	3644	NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e4e5d77570b59bdf8aed3c5cf0baebd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/712-1-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/712-2-0x0000000007D40000-0x00000000082E4000-memory.dmp

Filesize
5.6MB

Download
memory/712-3-0x0000000007830000-0x00000000078C2000-memory.dmp

Filesize
584KB

Download
memory/712-4-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

Filesize
64KB

Download
memory/712-5-0x00000000079E0000-0x00000000079EA000-memory.dmp

Filesize
40KB

Download
memory/712-6-0x0000000008910000-0x0000000008F28000-memory.dmp

Filesize
6.1MB

Download
memory/712-7-0x0000000007BE0000-0x0000000007CEA000-memory.dmp

Filesize
1.0MB

Download
memory/712-8-0x0000000007AD0000-0x0000000007AE2000-memory.dmp

Filesize
72KB

Download
memory/712-9-0x0000000007B30000-0x0000000007B6C000-memory.dmp

Filesize
240KB

Download
memory/712-10-0x0000000007B70000-0x0000000007BBC000-memory.dmp

Filesize
304KB

Download
memory/712-11-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/712-12-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads