redline | 4acfbea2a0c4f806c303ab7875cbdb0a8fe60d3df9a67d063f7170e01615ed0b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:35

Target

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
Size

313KB
MD5

6754d3c831c2392dd5a35b5768df4c37
SHA1

3a1bac47966c643c1587b734f19e7963c56e8dee
SHA256

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9
SHA512

2d373f936746f2bf962dbac09779d1b7c7f93dec7d8728f2c3db8bda36da290539e49b8d3bdcbeef28ab1d6e126f8632c009f5583ebb1b2d3cba4ba18e6245dd
SSDEEP

3072:QA0UpT1W+9dAoDc0ib8fy+8EnelxlmyxkMRqfjDv/YUeqiOL2bBOJ:4sHdGjb8KNxADMRqfjD4aL

Score

10^/10

Family

redline

Botnet

92.222.212.74:1450

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000290000-0x00000000002E4000-memory.dmp	family_redline

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 1704 WerFault.exe 715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

pid	pid_target	process	target process
2616	1704	WerFault.exe	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

description	pid	process	target process
PID 1704 wrote to memory of 2616	1704	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	WerFault.exe
PID 1704 wrote to memory of 2616	1704	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	WerFault.exe
PID 1704 wrote to memory of 2616	1704	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	WerFault.exe
PID 1704 wrote to memory of 2616	1704	715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe
"C:\Users\Admin\AppData\Local\Temp\715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 536
  2⤵
  - Program crash
  PID:2616

memory/1704-0-0x0000000000290000-0x00000000002E4000-memory.dmp

Filesize
336KB

Download
memory/1704-1-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/1704-2-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download