redline | b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 01:03

Target

b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5.exe
Size

141KB
MD5

7fcb91d10fe0ca177b46ee4afe46f834
SHA1

f10ee865a62923024cdb9681f488dad4d41afff8
SHA256

b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5
SHA512

eb6a33324d0b1a6ee60fb3098c844111503d4750c58ae46e769ae8dc891be2d3040a51fb239e2942060e8049e340691a0c7f43ba1456e5bb7f07d477dc45e557
SSDEEP

3072:RK1JZOpTvVQZ+rcIeRYs6YmszJqoD2r7BpGGoMTb3R35dINX9r5Wx0:AOpu0rjeRbVJqoD21pGGoMTb3RDINN

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2796-0-0x0000000000A00000-0x0000000000A2A000-memory.dmp	family_redline

Kills process with taskkill 1 IoCs

evasion

pid	Process
3264	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5.exe
Token: SeDebugPrivilege	3264	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4892	2796	b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5.exe	93
PID 2796 wrote to memory of 4892	2796	b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5.exe	93
PID 2796 wrote to memory of 4892	2796	b8d0d8de96b67426c07e2735824fb59362b614547a6e45f206d3d66939c998c5.exe	93
PID 4892 wrote to memory of 3264	4892	cmd.exe	95
PID 4892 wrote to memory of 3264	4892	cmd.exe	95
PID 4892 wrote to memory of 3264	4892	cmd.exe	95
PID 4892 wrote to memory of 4676	4892	cmd.exe	97
PID 4892 wrote to memory of 4676	4892	cmd.exe	97
PID 4892 wrote to memory of 4676	4892	cmd.exe	97

memory/2796-0-0x0000000000A00000-0x0000000000A2A000-memory.dmp

Filesize
168KB

Download
memory/2796-1-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/2796-2-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/2796-3-0x0000000005B10000-0x0000000006128000-memory.dmp

Filesize
6.1MB

Download
memory/2796-4-0x00000000053E0000-0x00000000053F2000-memory.dmp

Filesize
72KB

Download
memory/2796-5-0x0000000005440000-0x000000000547C000-memory.dmp

Filesize
240KB

Download
memory/2796-6-0x0000000005480000-0x00000000054CC000-memory.dmp

Filesize
304KB

Download
memory/2796-7-0x0000000005700000-0x000000000580A000-memory.dmp

Filesize
1.0MB

Download
memory/2796-8-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download