Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Redline St...ed.exe
windows11-21h2-x64
1Redline St...ld.exe
windows11-21h2-x64
10Redline St...52.dll
windows11-21h2-x64
1Redline St...ib.dll
windows11-21h2-x64
1Redline St...UI.dll
windows11-21h2-x64
1Redline St...db.dll
windows11-21h2-x64
1Redline St...db.dll
windows11-21h2-x64
1Redline St...ks.dll
windows11-21h2-x64
1Redline St...il.dll
windows11-21h2-x64
1Redline St...on.dll
windows11-21h2-x64
1Redline St...ls.dll
windows11-21h2-x64
1Redline St...en.dll
windows11-21h2-x64
1Redline St...ib.dll
windows11-21h2-x64
1Redline St...er.exe
windows11-21h2-x64
1Redline St...et.dll
windows11-21h2-x64
1Redline St...ub.exe
windows11-21h2-x64
10Redline St...rt.bat
windows11-21h2-x64
8Redline St...ed.exe
windows11-21h2-x64
10Analysis
-
max time kernel
6s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/05/2024, 14:26
Behavioral task
behavioral1
Sample
Redline Stealer Builder (Modified Variant)/RedLine_Clipper_Cracked.exe
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
Redline Stealer/Libraries/Build.exe
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
Redline Stealer/Libraries/Bunifu_UI_v1.52.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Redline Stealer/Libraries/GuiLib.dll
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
Redline Stealer/Libraries/MetroSet UI.dll
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
Redline Stealer/Libraries/Mono.Cecil.Mdb.dll
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
Redline Stealer/Libraries/Mono.Cecil.Pdb.dll
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
Redline Stealer/Libraries/Mono.Cecil.Rocks.dll
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
Redline Stealer/Libraries/Mono.Cecil.dll
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
Redline Stealer/Libraries/Newtonsoft.Json.dll
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
Redline Stealer/Libraries/RedLine.SharedModels.dll
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
Redline Stealer/Libraries/System.Drawing.Pen.dll
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Redline Stealer/Libraries/Vestris.ResourceLib.dll
Resource
win11-20240419-en
Behavioral task
behavioral14
Sample
Redline Stealer/Libraries/builder.exe
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
Redline Stealer/Libraries/protobuf-net.dll
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
Redline Stealer/Libraries/stub.exe
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
Redline Stealer/OpenPort.bat
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
Redline Stealer/RedLine.MainPanel-cracked.exe
Resource
win11-20240508-en
General
-
Target
Redline Stealer/Libraries/Build.exe
-
Size
141KB
-
MD5
1035bbf6b782b7a8819fa9bc616a9657
-
SHA1
e24f76eeaa29637aedd374f0087492d24aca22eb
-
SHA256
4060699be22d52cd3753fa0bb8d3147a7b14b4ee9769013f2f0ad284586911cb
-
SHA512
fb6ca81949db5bdf70ad294d68e3af534cb5e823558ac9428712a04d68b4b7413b00e3e465ad09e0e19572c777b6de7decaf705df3394177ba5792ec274e06d9
-
SSDEEP
3072:dK1JZOpTvVQZ+rcIeRYs6YmszJqoD2P7BpGGoMTb3R35dINX9r5Mxw:8Opu0rjeRbVJqoD61pGGoMTb3RDINN
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3144-1-0x0000000000D10000-0x0000000000D3A000-memory.dmp family_redline -
Kills process with taskkill 1 IoCs
pid Process 2680 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3144 Build.exe Token: SeDebugPrivilege 2680 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3144 wrote to memory of 4476 3144 Build.exe 80 PID 3144 wrote to memory of 4476 3144 Build.exe 80 PID 3144 wrote to memory of 4476 3144 Build.exe 80 PID 4476 wrote to memory of 2680 4476 cmd.exe 82 PID 4476 wrote to memory of 2680 4476 cmd.exe 82 PID 4476 wrote to memory of 2680 4476 cmd.exe 82 PID 4476 wrote to memory of 5016 4476 cmd.exe 84 PID 4476 wrote to memory of 5016 4476 cmd.exe 84 PID 4476 wrote to memory of 5016 4476 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline Stealer\Libraries\Build.exe"C:\Users\Admin\AppData\Local\Temp\Redline Stealer\Libraries\Build.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 3144 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Redline Stealer\Libraries\Build.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 31443⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵PID:5016
-
-