redline | c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423

Analysis

max time kernel
92s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 19:01

Target

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe
Size

484KB
MD5

5e88980bb982663f2d687fd72bacd880
SHA1

04ea23d8cc91ee71b13476b4b60eee4fe478e01c
SHA256

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423
SHA512

06b744b1a238c76b90a1182315838ee22e240cbd33d7ba9fabca344abca6e52e20fdfcd965febc18d82d05ad478aff7a4720715d7ed124ead75d9b91afc8301d
SSDEEP

12288:+h1Fk70Tnvjct35lxE/Ui3kzubOm45V2dHgEIqSOJ:Ik70TrcZxE/USkzuN8OJ

Score

10^/10

Family

redline

Botnet

siski

168.119.242.255:7742

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3296-9-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/4880-0-0x00000000026C0000-0x0000000002726000-memory.dmp	net_reactor
behavioral2/memory/4880-3-0x0000000004DD0000-0x0000000004DE0000-memory.dmp	net_reactor
behavioral2/memory/4880-6-0x0000000004C10000-0x0000000004C74000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe

description	pid	process	target process
PID 4880 set thread context of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1452 3296 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
1452	3296	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe

description	pid	process	target process
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe
PID 4880 wrote to memory of 3296	4880	c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 788
3⤵
- Program crash
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3296 -ip 3296
1⤵
PID:3476

memory/3296-9-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3296-14-0x0000000074B40000-0x00000000752F1000-memory.dmp

Filesize
7.7MB

Download
memory/4880-0-0x00000000026C0000-0x0000000002726000-memory.dmp

Filesize
408KB

Download
memory/4880-1-0x0000000074B40000-0x00000000752F1000-memory.dmp

Filesize
7.7MB

Download
memory/4880-4-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4880-3-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4880-2-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/4880-5-0x0000000004DE0000-0x0000000005386000-memory.dmp

Filesize
5.6MB

Download
memory/4880-6-0x0000000004C10000-0x0000000004C74000-memory.dmp

Filesize
400KB

Download
memory/4880-11-0x0000000002730000-0x0000000004730000-memory.dmp

Filesize
32.0MB

Download
memory/4880-13-0x0000000074B40000-0x00000000752F1000-memory.dmp

Filesize
7.7MB

Download