redline | fcf6a71c1a791791cc09eae2a9c31ed0f8faaff2af2fa3b9b3b0026297e7803c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:51

Target

4b62e916810781eec06c47093c68b180_NEIKI.exe
Size

1.3MB
MD5

4b62e916810781eec06c47093c68b180
SHA1

f4010b986879e263ab06f8f63c92a813b2ea4461
SHA256

fcf6a71c1a791791cc09eae2a9c31ed0f8faaff2af2fa3b9b3b0026297e7803c
SHA512

d611386f9103e15a6b54dc245a7377379a8fd79dfe7f8e0966ab05209eaee8520bfef474f6d709e6815fd75af815cfa4a6a4e304c74298d3d076553a5192a321
SSDEEP

24576:ezar37SD/6+szvzMF9yeVSvr4cSuGMM9szKgAt3ugWT:ZSD/6+szvzMoT4cSxMM9szKgANufT

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2176-3-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/2176-9-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/2176-7-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/2176-5-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/2176-2-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2424 set thread context of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29
PID 2424 wrote to memory of 2176	2424	4b62e916810781eec06c47093c68b180_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\4b62e916810781eec06c47093c68b180_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4b62e916810781eec06c47093c68b180_NEIKI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2176

memory/2176-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-9-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-7-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-2-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2176-10-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2176-11-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-12-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/2176-13-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download