redline | e5e5d8f93c5b2df051962b4aec10d2f75207e6b3113ae85faa2d810ca4bcf616 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 21:30

Sharing

Report Analysis Logs

General

Target

file.exe
Size

488KB
MD5

b6d1f343014dc55ef2588ca861db518b
SHA1

896f1eb79619be7dcfe3f3b137a59f2ea2712fd7
SHA256

e5e5d8f93c5b2df051962b4aec10d2f75207e6b3113ae85faa2d810ca4bcf616
SHA512

b015c947158b34241a789b15b248e81e7483a69b519b4df0cd99614219debd8bd57fedfc05788ab97c23402a17dac061284aace69a93951dc1edfd686adc2c52
SSDEEP

12288:93re4RXLKXpN3zZ8+A+PbjNHsX+54YzHiegI5pRO0:3RXOXpNVr4+GEHi4U

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2908-0-0x0000000001280000-0x00000000012FE000-memory.dmp	family_redline

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2792	2908	file.exe	29
PID 2908 wrote to memory of 2792	2908	file.exe	29
PID 2908 wrote to memory of 2792	2908	file.exe	29
PID 2908 wrote to memory of 2792	2908	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 92
  2⤵
  - Program crash
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000001280000-0x00000000012FE000-memory.dmp

Filesize
504KB

Download