redline | a3cc4fff4aac80dd379ae09712229eff389c1172d888180dbce61715965f4885

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a42fac1d3d105d69d0baeb02cc93107e.exe
Size 415KB
Sample231114-l6e17abc2x
SHA256 a3cc4fff4aac80dd379ae09712229eff389c1172d888180dbce61715965f4885
MD5 a42fac1d3d105d69d0baeb02cc93107e
SHA1 635fb563e0e4b95301e459cc3f59caae431b5e33
SHA512 a6a444de848603d253048f58c455fb73d2a926c13e608ebcf770f66f4b850cb291cf17d2ff5abc5c0c4a441857fd11cb996aec2a27ffde921a9f269cd56530f6
SSDEEP 6144:RWIU/FKe4lNUq/Vr58AO00HHY8Y+IxyCq+DX/buAfotdnJ/mgb0q0:XU9KeIB589nY8Y+IkCrfotdJ+gb03
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline taiga infostealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/1888-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1888-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1888-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1888-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1888-2-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/1888-11-0x0000000007170000-0x00000000071B0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 2360	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	29
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30
PID 1896 wrote to memory of 1888	1896	a42fac1d3d105d69d0baeb02cc93107e.exe	30

C:\Users\Admin\AppData\Local\Temp\a42fac1d3d105d69d0baeb02cc93107e.exe
"C:\Users\Admin\AppData\Local\Temp\a42fac1d3d105d69d0baeb02cc93107e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-5-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1888-3-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-2-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1888-10-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Download

memory/1888-11-0x0000000007170000-0x00000000071B0000-memory.dmp

Download

memory/1888-12-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Download

memory/1888-13-0x0000000007170000-0x00000000071B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads