redline | eb4a47653abbe7e92a1d264521f00e82b485bf14fdde046aaa4291f495ae96f9

Analysis

max time kernel
165s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:39

Target

a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe
Size

313KB
MD5

9aa8737202bac7dcc71ef4c77939f82b
SHA1

25b29b7274fb3ef7d16052f8400d24540621aff9
SHA256

a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff
SHA512

aa55987a32b3e259376594df68a2008007353953a2bf390b44b908e5fdaee181d3b216aec46f8679aa5f5e4164a0a412511621c6249d3cab7e1eba86d8494a7a
SSDEEP

3072:UA0KubVwL+uacYOFq70W09SIg8DJn5MxfCpWLMRqfjDv/YheqiOL2bBO2:8Qpaw40r8IDYx64MRqfjD4jL

Score

10^/10

Family

redline

Botnet

@RLREBORN Cloud TG: @FATHEROFCARDERS)

141.95.211.148:46011

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4480-1-0x0000000000EB0000-0x0000000000F04000-memory.dmp	family_redline

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1684	4480	WerFault.exe	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe
2812	4480	WerFault.exe	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe

description	pid	process	target process
PID 4480 wrote to memory of 1684	4480	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe
PID 4480 wrote to memory of 1684	4480	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe
PID 4480 wrote to memory of 1684	4480	a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe
"C:\Users\Admin\AppData\Local\Temp\a177d02e062d3068da14ad638fe58ce76d614fa15c1890f668747c61bd132aff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 800
2⤵
- Program crash
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 800
2⤵
- Program crash
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4480 -ip 4480
1⤵
PID:3136

memory/4480-0-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4480-1-0x0000000000EB0000-0x0000000000F04000-memory.dmp

Filesize
336KB

Download
memory/4480-2-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download