redline | 0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10

Analysis

max time kernel
137s
max time network
150s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 16:14

Target

NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe
Size

414KB
MD5

c2ca9289d96aff9a0ccfcc41c25cd0f7
SHA1

d8c956b87accabd4079f08908712c03a40f21644
SHA256

0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10
SHA512

31e1cc4c9eac6adca67bb92db844a7fc527df9c119a99d49e1e2e155f10b8fb55f7e06e65221391f1525c43d7b9440118c2b60f60137d28cc5fb7269daec3e2f
SSDEEP

6144:wU5gUwlREXKMmn/P3dAOkXjjuJef8EFY5Abk8Tvrx1sgy3jU4DCH9:BgUKRE6Td2SJg48Cgy3e9

Score

10^/10

Family

redline

Botnet

taiga

5.42.92.51:19057

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/2072-2-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2072-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2072-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2072-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2072-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2072-11-0x00000000072E0000-0x0000000007320000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29
PID 1036 wrote to memory of 2072	1036	NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0bbc5d27d984dd680feb23e3aeae57f7139953d3efb11926b65952b5f664cf10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2072

memory/2072-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2072-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2072-10-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-11-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download
memory/2072-12-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-13-0x00000000072E0000-0x0000000007320000-memory.dmp

Filesize
256KB

Download