redline | 35fa914c6357cde578322016bb343396ee5cbe965e37dbbc27e58563c27f3d00

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:02

Target

472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe
Size

413KB
MD5

d9b1bbeef5c6848bd16a1818f6bf14d4
SHA1

90935fd1d36a1317adc4925ab243bd2b6b3bdb8c
SHA256

472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d
SHA512

e06ccaeb983b83a3086c6bdbabbbad8e8e882c14beb14f3b289c98b096782a42c5f8800849c632873f5978afe513a7bc12a54597a582008c2420ec4c842c9279
SSDEEP

6144:s2Cc1vkeamA7uqck0h6OjAOnHhfGRlk30YXljPVjjyjjLj4RjMjjcjjKj9mJ37:s2J1ceamvBVHhfGg30YXljW037

Score

10^/10

Family

redline

Botnet

darts

77.91.124.82:19071

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/3520-0-0x0000000000400000-0x0000000000430000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe

description	pid	process	target process
PID 3184 set thread context of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4956 3184 WerFault.exe 472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe

pid	pid_target	process	target process
4956	3184	WerFault.exe	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe

description	pid	process	target process
PID 3184 wrote to memory of 4356	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 4356	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 4356	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe
PID 3184 wrote to memory of 3520	3184	472b4c438a30ae51bf83b08a063b74c043ceb6bb1706403bef38aa3a9afbda4d.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 312
2⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3184 -ip 3184
1⤵
PID:2284

memory/3520-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3520-1-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/3520-2-0x0000000001910000-0x0000000001916000-memory.dmp

Filesize
24KB

Download
memory/3520-3-0x0000000005FD0000-0x00000000065E8000-memory.dmp

Filesize
6.1MB

Download
memory/3520-4-0x0000000005AC0000-0x0000000005BCA000-memory.dmp

Filesize
1.0MB

Download
memory/3520-5-0x0000000003310000-0x0000000003322000-memory.dmp

Filesize
72KB

Download
memory/3520-7-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/3520-6-0x0000000003370000-0x00000000033AC000-memory.dmp

Filesize
240KB

Download
memory/3520-8-0x0000000005910000-0x000000000595C000-memory.dmp

Filesize
304KB

Download
memory/3520-9-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/3520-10-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download