redline | e93e1bc916a1c530997476aa46c20e09954403519d49063aecb3bd7cf1b3d015

Analysis

max time kernel
140s
max time network
157s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 04:30

Target

NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe
Size

311KB
MD5

fe6aa6b62ec619150b2b02d0bbf412d0
SHA1

00c9387661e70c14a9864bf924a4a337b8659494
SHA256

e93e1bc916a1c530997476aa46c20e09954403519d49063aecb3bd7cf1b3d015
SHA512

c87a62455255f33711ebfd782da86ebe767569a78e1fc27d26b56561e2a24f50c9a2e4323284603a6446d706f2eecd227503e0ff6d2fce2887a81b348c2ae440
SSDEEP

3072:zjlomiD4ecS37wnKHZtRjHAUUpP+/JNYnr9gg24Fic0STdy9KPr7gkCWaHR+i6Z/:P3AE2wKDWneR2H0STdqIGjbc

Score

10^/10

Family

redline

Botnet

taiga

5.42.92.51:19057

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2940-2-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2940-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2940-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2940-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2940-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2940-11-0x0000000000DF0000-0x0000000000E30000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29
PID 2244 wrote to memory of 2940	2244	NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.fe6aa6b62ec619150b2b02d0bbf412d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2940

memory/2940-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2940-10-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-11-0x0000000000DF0000-0x0000000000E30000-memory.dmp

Filesize
256KB

Download
memory/2940-12-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-13-0x0000000000DF0000-0x0000000000E30000-memory.dmp

Filesize
256KB

Download