redline | 345eec7fa7500089f3ad591521ffc2288b38d8a544f0af4a27a84f3197ee696a

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:36

Target

e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe
Size

313KB
MD5

f733785f9d088490b784d4dc5584ebfb
SHA1

6c073d4208fee7cc88a235a3759b586889b91adf
SHA256

e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59
SHA512

43589b18333b0edcd6e300577f86de685058df5533bcbfdd3e30497aa76176008125fbd28deecaca5e6132c42cc5c0a583c34497f40dbe4ea577333eaebab899
SSDEEP

3072:kA05OJdM+K9F3OFq70W09SIg8Ikn2YSxx1m6MRqfjDv/YUeqiOL2bBOE:sma9Y40r8IIDxx9MRqfjD4aL

Score

10^/10

Family

redline

Botnet

@oni912

45.15.156.209:40481

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2456-0-0x0000000001200000-0x0000000001254000-memory.dmp	family_redline

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2068 2456 WerFault.exe e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe

pid	pid_target	process	target process
2068	2456	WerFault.exe	e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe

description	pid	process	target process
PID 2456 wrote to memory of 2068	2456	e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe	WerFault.exe
PID 2456 wrote to memory of 2068	2456	e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe	WerFault.exe
PID 2456 wrote to memory of 2068	2456	e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe	WerFault.exe
PID 2456 wrote to memory of 2068	2456	e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe
"C:\Users\Admin\AppData\Local\Temp\e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 536
2⤵
- Program crash
PID:2068

memory/2456-0-0x0000000001200000-0x0000000001254000-memory.dmp

Filesize
336KB

Download
memory/2456-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2456-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download