redline | 47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288

General

Target

47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe
Size

1.1MB
MD5

e2ddbc9770edb5ec6528f89c52c893a4
SHA1

e3b664e167219368c232fe0d4003c889414f94bd
SHA256

47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288
SHA512

ee609adb22a89fb9460234e31ba8bbf9d06452c3e713b85f543cf1d4dcd814a73e7794b71ece7ddbddf3342e948d76fc16a095f7fbbca522780efa22c9d3e815
SSDEEP

12288:floH6cfu3Yp9M8iCNC8y0L5gagKYDZB/DEwP+umyIyT0kQGerEoQKl9cIiE+h:CHhfu3Yp9M8iCQ895yBDZB/zWGeAoZ

Score

10^/10

redline logsdiller cloud (telegram: @logsdillabot)infostealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

194.169.175.234:27221

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2448-9-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2448-11-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2448-5-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2448-7-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/2448-4-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2324	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	28
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29
PID 2256 wrote to memory of 2448	2256	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	29

C:\Users\Admin\AppData\Local\Temp\47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe
"C:\Users\Admin\AppData\Local\Temp\47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-2-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-11-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2448-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-12-0x00000000743FE000-0x00000000743FF000-memory.dmp

Filesize
4KB

Download
memory/2448-13-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download
memory/2448-14-0x00000000743FE000-0x00000000743FF000-memory.dmp

Filesize
4KB

Download
memory/2448-15-0x00000000743F0000-0x0000000074ADE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing