redline | eb4a47653abbe7e92a1d264521f00e82b485bf14fdde046aaa4291f495ae96f9

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:39

Target

a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe
Size

313KB
MD5

9aa8737202bac7dcc71ef4c77939f82b
SHA1

25b29b7274fb3ef7d16052f8400d24540621aff9
SHA256

a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff
SHA512

aa55987a32b3e259376594df68a2008007353953a2bf390b44b908e5fdaee181d3b216aec46f8679aa5f5e4164a0a412511621c6249d3cab7e1eba86d8494a7a
SSDEEP

3072:UA0KubVwL+uacYOFq70W09SIg8DJn5MxfCpWLMRqfjDv/YheqiOL2bBO2:8Qpaw40r8IDYx64MRqfjD4jL

Score

10^/10

Family

redline

Botnet

@RLREBORN Cloud TG: @FATHEROFCARDERS)

141.95.211.148:46011

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/884-0-0x0000000000DA0000-0x0000000000DF4000-memory.dmp	family_redline

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 884 WerFault.exe a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe

pid	pid_target	process	target process
2692	884	WerFault.exe	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe

description	pid	process	target process
PID 884 wrote to memory of 2692	884	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe
PID 884 wrote to memory of 2692	884	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe
PID 884 wrote to memory of 2692	884	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe
PID 884 wrote to memory of 2692	884	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe
"C:\Users\Admin\AppData\Local\Temp\a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 540
2⤵
- Program crash
PID:2692

memory/884-0-0x0000000000DA0000-0x0000000000DF4000-memory.dmp

Filesize
336KB

Download
memory/884-1-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/884-2-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download