redline | 47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288

Analysis

max time kernel
288s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/05/2024, 05:52

Target

47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe
Size

1.1MB
MD5

e2ddbc9770edb5ec6528f89c52c893a4
SHA1

e3b664e167219368c232fe0d4003c889414f94bd
SHA256

47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288
SHA512

ee609adb22a89fb9460234e31ba8bbf9d06452c3e713b85f543cf1d4dcd814a73e7794b71ece7ddbddf3342e948d76fc16a095f7fbbca522780efa22c9d3e815
SSDEEP

12288:floH6cfu3Yp9M8iCNC8y0L5gagKYDZB/DEwP+umyIyT0kQGerEoQKl9cIiE+h:CHhfu3Yp9M8iCQ895yBDZB/zWGeAoZ

Score

10^/10

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

194.169.175.234:27221

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/68-0-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 212	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	73
PID 4520 wrote to memory of 212	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	73
PID 4520 wrote to memory of 212	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	73
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74
PID 4520 wrote to memory of 68	4520	47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe	74

C:\Users\Admin\AppData\Local\Temp\47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe
"C:\Users\Admin\AppData\Local\Temp\47e21ddc3a9c6ba14d207bd23cd5dd155df00f3952f9e25c3f962b944bf89288.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:68

memory/68-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/68-3-0x0000000073EDE000-0x0000000073EDF000-memory.dmp

Filesize
4KB

Download
memory/68-5-0x000000000B8D0000-0x000000000BDCE000-memory.dmp

Filesize
5.0MB

Download
memory/68-6-0x000000000B3D0000-0x000000000B462000-memory.dmp

Filesize
584KB

Download
memory/68-7-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/68-8-0x0000000001010000-0x000000000101A000-memory.dmp

Filesize
40KB

Download
memory/68-9-0x000000000C3E0000-0x000000000C9E6000-memory.dmp

Filesize
6.0MB

Download
memory/68-10-0x000000000BEE0000-0x000000000BFEA000-memory.dmp

Filesize
1.0MB

Download
memory/68-11-0x000000000B550000-0x000000000B562000-memory.dmp

Filesize
72KB

Download
memory/68-12-0x000000000B5B0000-0x000000000B5EE000-memory.dmp

Filesize
248KB

Download
memory/68-13-0x000000000B720000-0x000000000B76B000-memory.dmp

Filesize
300KB

Download
memory/68-18-0x0000000073EDE000-0x0000000073EDF000-memory.dmp

Filesize
4KB

Download
memory/68-25-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download