redline | 4549139bf1668e28f6f9c0018143eaa5f1a3447f358a926cd3626171a160adc8

Analysis

max time kernel
290s
max time network
302s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12Xk479.exe
Size 315KB
Sample231113-llb4ssbh4x
SHA256 4549139bf1668e28f6f9c0018143eaa5f1a3447f358a926cd3626171a160adc8
MD5 f64761546f5ccea6036f8a0995e004b1
SHA1 e6173536fc3652a74f96a71057069920c47a32f9
SHA512 0c03482e3b6451a6b6b5a2855bca51e8b595e7e7b80c571818448bb06287d888fcfcd2b634c1c151a4d26e4a38b2aace83a460e99084d5b43b4921db0a9395ab
SSDEEP 6144:aKWeIhzyZNGu5rMkDnscALbYHKY2XRIW/dCfIFkHa+Zrdj/tUC8LXZvg9MaCPscP:aKWewyTMks7L8HKY2XRIW/dCfIFkHa+a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline taiga infostealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/1992-4-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1992-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1992-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1992-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1992-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1992-13-0x0000000007200000-0x0000000007240000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1992	1640	12Xk479.exe	29

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29
PID 1640 wrote to memory of 1992	1640	12Xk479.exe	29

C:\Users\Admin\AppData\Local\Temp\12Xk479.exe
"C:\Users\Admin\AppData\Local\Temp\12Xk479.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-2-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-4-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-5-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1992-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-12-0x0000000074BA0000-0x000000007528E000-memory.dmp

Download

memory/1992-13-0x0000000007200000-0x0000000007240000-memory.dmp

Download

memory/1992-14-0x0000000074BA0000-0x000000007528E000-memory.dmp

Download

memory/1992-15-0x0000000007200000-0x0000000007240000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads