redline | b287dced5d97f2f8cf9b3fe6f5885addc12b485aafe5553d403cfa1aa1b6f88f

Analysis

max time kernel
136s
max time network
149s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 20:54

Target

NEAS.dfa9e951c06740a60e559a0e10606060.exe
Size

1.1MB
MD5

dfa9e951c06740a60e559a0e10606060
SHA1

bafb6217120091409c0e150740f435e2caa1051a
SHA256

b287dced5d97f2f8cf9b3fe6f5885addc12b485aafe5553d403cfa1aa1b6f88f
SHA512

42bf91eb9a252218cbad960495b9e7f4904b64f864c8bb6001da36061a3299960dac11caa2952b78190b381625af5d0f99c39f299f86c75fdab9b69a0fb79e56
SSDEEP

24576:sC5gjLHWdgAw/26p6Xy6GbSROMh4dh9SciZBPiH:sUTw/26p6CARJEh9Sc2PiH

Score

10^/10

Family

redline

Botnet

grome

77.91.124.86:19084

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2808-2-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2808-3-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2808-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2808-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2808-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.dfa9e951c06740a60e559a0e10606060.exe

description pid process target process

PID 2840 set thread context of 2808 2840 NEAS.dfa9e951c06740a60e559a0e10606060.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2620 2840 WerFault.exe NEAS.dfa9e951c06740a60e559a0e10606060.exe

description	pid	process	target process
PID 2840 set thread context of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe

pid	pid_target	process	target process
2620	2840	WerFault.exe	NEAS.dfa9e951c06740a60e559a0e10606060.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

NEAS.dfa9e951c06740a60e559a0e10606060.exe

description	pid	process	target process
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2808	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	AppLaunch.exe
PID 2840 wrote to memory of 2620	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	WerFault.exe
PID 2840 wrote to memory of 2620	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	WerFault.exe
PID 2840 wrote to memory of 2620	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	WerFault.exe
PID 2840 wrote to memory of 2620	2840	NEAS.dfa9e951c06740a60e559a0e10606060.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 92
2⤵
- Program crash
PID:2620

memory/2808-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2808-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-10-0x0000000073B80000-0x000000007426E000-memory.dmp

Filesize
6.9MB

Download
memory/2808-11-0x00000000072D0000-0x0000000007310000-memory.dmp

Filesize
256KB

Download
memory/2808-12-0x0000000073B80000-0x000000007426E000-memory.dmp

Filesize
6.9MB

Download
memory/2808-13-0x00000000072D0000-0x0000000007310000-memory.dmp

Filesize
256KB

Download