redline | fdad89fe9db1c6caa09660a2abd2a99e73a8f442dec417ff49b22614057c74ca

Analysis

max time kernel
137s
max time network
152s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 09:33

Target

0200d4d6104237ccf6475f3beef56228.exe
Size

415KB
MD5

0200d4d6104237ccf6475f3beef56228
SHA1

f6e7d9339a664c1a2c344990124d5e5ffe6aec3d
SHA256

fdad89fe9db1c6caa09660a2abd2a99e73a8f442dec417ff49b22614057c74ca
SHA512

835567682922ddc35fda96869372fbb764bfacdb99742d9628e944934657afc28a3161910bb78e8819575f5384386ac3bfab74ae43c65bce594a0f3e1496cb58
SSDEEP

6144:MOykMFF2Wb2U4nDjcAOzyHF5HOt0q9tg36PuocNaZy8ZnC:Uk+F2wccw/HOBa6PuocNaZE

Score

10^/10

Family

redline

Botnet

taiga

5.42.92.51:19057

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2824-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2824-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2824-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2824-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2824-2-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2824-11-0x0000000000840000-0x0000000000880000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2844	2496	0200d4d6104237ccf6475f3beef56228.exe	29
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30
PID 2496 wrote to memory of 2824	2496	0200d4d6104237ccf6475f3beef56228.exe	30

C:\Users\Admin\AppData\Local\Temp\0200d4d6104237ccf6475f3beef56228.exe
"C:\Users\Admin\AppData\Local\Temp\0200d4d6104237ccf6475f3beef56228.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2824

memory/2824-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2824-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-10-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2824-11-0x0000000000840000-0x0000000000880000-memory.dmp

Filesize
256KB

Download
memory/2824-12-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2824-13-0x0000000000840000-0x0000000000880000-memory.dmp

Filesize
256KB

Download