redline | 45e94c10bbc148cc1f0e810ef4a64b3b2814960515bbe6c69d8570dde960e0b2

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 11:12

Target

f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe
Size

302KB
MD5

969c5dc0eb8b8253a0fd37a496f58ef1
SHA1

4aa6a4c1c19bff665b5638f70cdc0d9bb7e262df
SHA256

f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd
SHA512

3314b40bcbe666e4747cd993b5d8663a1e12957efc9c299b4796bae4c43af35d58c75eec3be1bc8de17d5c5d80e5f8b9c485a3eaceb1a4fe1d31949bb40a403c
SSDEEP

6144:QWzRT5OXkMMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRcx:X1T5nD7NQSzrs5kLJhHVugiqtciLR

Score

10^/10

Family

redline

Botnet

crazy

83.97.73.129:19068

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral20/memory/1704-9-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral20/memory/1704-8-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline
behavioral20/memory/1704-2-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29
PID 2128 wrote to memory of 1704	2128	f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe	29

C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe
"C:\Users\Admin\AppData\Local\Temp\f066a86310e9df931f9ad80a096c41561564e2e05f5b6865c8531b7abf16e0dd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  PID:1704

memory/1704-9-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1704-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1704-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1704-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1704-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1704-10-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/1704-11-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/1704-12-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-13-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/1704-14-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/2128-0-0x0000000000A27000-0x0000000000A28000-memory.dmp

Filesize
4KB

Download