redline | 79af824c2511cf8c07b71df07ffa95badbf3e6a418885a6f7a66b264422efd90 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 18:28

Sharing

Report Analysis Logs

General

Target

amanai.exe
Size

303KB
MD5

d110240d28bd7cfc01f1fddd76c765d4
SHA1

f4aa010ce8b2f86866db4777f3eec7208bd333d7
SHA256

79af824c2511cf8c07b71df07ffa95badbf3e6a418885a6f7a66b264422efd90
SHA512

e8a6b720ade625181d8726be3584352baa8e04b9eb6b89d46c6b6bbcf814ef956bba6d4b1f680bfd3e96b2bfe391b539d58278aa5cc348dd9ab1f3b068fa9d5b
SSDEEP

6144:FdTtNZDGHLeI0vRc7CSyeCzXxx9SLmNeI/44H/7:Pt7DGHN+VXN/NZ/7

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2368-0-0x00000000002B0000-0x00000000002DE000-memory.dmp	family_redline

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3052 2368 WerFault.exe amanai.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

amanai.exe

description	pid	process	target process
PID 2368 wrote to memory of 3052	2368	amanai.exe	WerFault.exe
PID 2368 wrote to memory of 3052	2368	amanai.exe	WerFault.exe
PID 2368 wrote to memory of 3052	2368	amanai.exe	WerFault.exe
PID 2368 wrote to memory of 3052	2368	amanai.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\amanai.exe
"C:\Users\Admin\AppData\Local\Temp\amanai.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 548
2⤵
- Program crash
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x00000000002B0000-0x00000000002DE000-memory.dmp

Filesize
184KB

Download
memory/2368-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2368-6-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download