redline | e5331799723ae13300f9a49b5588662a116adf662d373e4fea33c3b13b636b40

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:43

Target

9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe
Size

329KB
MD5

927fa2810d057f5b7740f9fd3d0af3c9
SHA1

b75d4c86d3b4fd9d6ecf4be05d9ebcf4d7fd7ec8
SHA256

9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9
SHA512

54af68949da4520c87e24d613817003705e8e50d3006e81dcf5d924003c1a1b8185ba89f6878c0abac61f34efbe7a9233f28ba3e678a35983c1e74216a5ac1a8
SSDEEP

6144:Y2A0vtQBor7oi2eemoLa9VBdH/Mz1KKd619AqUAwZuav:FA0v4ovo8NoLm5s5duBUAwJ

Score

10^/10

Family

redline

Botnet

@RLREBORN Cloud TG: @FATHEROFCARDERS)

141.95.211.148:46011

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2508-7-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2508-8-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2508-11-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2508-13-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/2508-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe

description	pid	process	target process
PID 2860 set thread context of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe

description	pid	process	target process
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe
PID 2860 wrote to memory of 2508	2860	9285f56d3f84131e78d09d2b85dad48a871eec4702cb6494e9c46a24f70e50f9.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2508

memory/2508-5-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2508-6-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2508-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2508-8-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2508-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-11-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2508-13-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2508-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-0-0x0000000000B00000-0x0000000000B56000-memory.dmp

Filesize
344KB

Download
memory/2860-1-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2860-4-0x0000000002510000-0x0000000004510000-memory.dmp

Filesize
32.0MB

Download
memory/2860-17-0x0000000074540000-0x0000000074C2E000-memory.dmp

Filesize
6.9MB

Download