redline | c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 19:01

Target

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe
Size

484KB
MD5

5e88980bb982663f2d687fd72bacd880
SHA1

04ea23d8cc91ee71b13476b4b60eee4fe478e01c
SHA256

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423
SHA512

06b744b1a238c76b90a1182315838ee22e240cbd33d7ba9fabca344abca6e52e20fdfcd965febc18d82d05ad478aff7a4720715d7ed124ead75d9b91afc8301d
SSDEEP

12288:+h1Fk70Tnvjct35lxE/Ui3kzubOm45V2dHgEIqSOJ:Ik70TrcZxE/USkzuN8OJ

Score

10^/10

Family

redline

Botnet

siski

168.119.242.255:7742

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3644-9-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1208-0-0x0000000002650000-0x00000000026B6000-memory.dmp	net_reactor
behavioral1/memory/1208-5-0x0000000004AA0000-0x0000000004B04000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe

description	pid	process	target process
PID 1208 set thread context of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5060 3644 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
5060	3644	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe

description	pid	process	target process
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 1208 wrote to memory of 3644	1208	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 928
3⤵
- Program crash
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3644 -ip 3644
1⤵
PID:5108

memory/1208-0-0x0000000002650000-0x00000000026B6000-memory.dmp

Filesize
408KB

Download
memory/1208-1-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1208-2-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1208-3-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1208-4-0x0000000004BF0000-0x0000000005194000-memory.dmp

Filesize
5.6MB

Download
memory/1208-5-0x0000000004AA0000-0x0000000004B04000-memory.dmp

Filesize
400KB

Download
memory/1208-6-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1208-12-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1208-13-0x00000000026E0000-0x00000000046E0000-memory.dmp

Filesize
32.0MB

Download
memory/3644-9-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3644-14-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download