redline | e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85

Analysis

max time kernel
289s
max time network
304s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
02-02-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe
Size

473KB
MD5

0ed83b921910401b1fe81d739957d364
SHA1

283a4c1e65dbedd256c8b63d3329585573a26cca
SHA256

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85
SHA512

17b8c12b33992673f2b93e631cc8b012e246028dd5f60491e386576a58f4c3d163d118c7526cb7b92f9c21732f73e36195527b4764d1289845063f6d745986ab
SSDEEP

12288:Vh1Fk70Tnvjc/pZcQAgUl1QrBxOKw5fmjMy0hAXAMvJEQyUl:nk70TrcfcQAgUluSYTBEQyA

Score

10^/10

redline logsdiller cloud (tg: @logsdillabot)infostealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

45.15.156.201:10208

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4976-8-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/4576-2-0x0000000004A70000-0x0000000004AD0000-memory.dmp	net_reactor
behavioral2/memory/4576-4-0x0000000005020000-0x0000000005080000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe

description	pid	process	target process
PID 4576 set thread context of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe

description	pid	process	target process
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe
PID 4576 wrote to memory of 4976	4576	e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe
"C:\Users\Admin\AppData\Local\Temp\e1350146ba52f8c6bd479470229b7d1ed05caa7aa96c1bc1c6f3a0518c0e8b85.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4576-12-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4576-2-0x0000000004A70000-0x0000000004AD0000-memory.dmp

Filesize
384KB

Download
memory/4576-0-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4576-3-0x0000000004B20000-0x000000000501E000-memory.dmp

Filesize
5.0MB

Download
memory/4576-4-0x0000000005020000-0x0000000005080000-memory.dmp

Filesize
384KB

Download
memory/4576-5-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/4576-21-0x00000000025F0000-0x00000000045F0000-memory.dmp

Filesize
32.0MB

Download
memory/4576-13-0x00000000025F0000-0x00000000045F0000-memory.dmp

Filesize
32.0MB

Download
memory/4576-1-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/4976-22-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4976-15-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/4976-14-0x0000000073710000-0x0000000073DFE000-memory.dmp

Filesize
6.9MB

Download
memory/4976-16-0x0000000005F70000-0x0000000006576000-memory.dmp

Filesize
6.0MB

Download
memory/4976-17-0x0000000005760000-0x000000000586A000-memory.dmp

Filesize
1.0MB

Download
memory/4976-18-0x0000000005070000-0x0000000005082000-memory.dmp

Filesize
72KB

Download
memory/4976-19-0x0000000005090000-0x00000000050CE000-memory.dmp

Filesize
248KB

Download
memory/4976-20-0x00000000050D0000-0x000000000511B000-memory.dmp

Filesize
300KB

Download
memory/4976-8-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4976-11-0x0000000004E00000-0x0000000004E92000-memory.dmp

Filesize
584KB

Download