redline | f3c9796ca11327d3e9dea426349da3962a379f1c81feee1e93da016ba37b2db1

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mоdmenu gta5/modest-menu.exe
Size

391KB
MD5

6fa8b408eabd31b852279fa5a872a441
SHA1

3a841e5628f6a35c285b5d4c5dfc238de76056db
SHA256

229b5412d38ab6be95fc30db6116b6b5b4f5f38ca0c83d13e8b5e5f485be0efc
SHA512

acddba6eb875db0595fbcf09ddae61c70448b55813acf076cad1ad1293460dcd61a3ce3617bd893b8abaf2be3ffdb8e241287e19fc940071e57a1ecc3d721067
SSDEEP

12288:ZFBZ98gjwtD9jTzfMMLMlg4Db97XIn6Bl:ZNwtFT7MMolg

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

91.199.154.172:15486

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/4716-8-0x0000000000500000-0x0000000000550000-memory.dmp	family_redline

Loads dropped DLL 1 IoCs

pid	Process
3232	modest-menu.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3232 set thread context of 4716	3232	modest-menu.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83
PID 3232 wrote to memory of 4716	3232	modest-menu.exe	83

C:\Users\Admin\AppData\Local\Temp\mоdmenu gta5\modest-menu.exe
"C:\Users\Admin\AppData\Local\Temp\mоdmenu gta5\modest-menu.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
419KB

MD5
0bfa52d474494e2bbd6446d1d886f6fc

SHA1
3d9dfde5392c262d1f193ff1eb9d441c962605e7

SHA256
8578a1ec7fe5eb13382c932fd58f2308e8bd139fc3f77c9ba1c90ae0aa8b1ecc

SHA512
005b8ab4e6f7a4c86bd255d55f77063e1b896918de586cdc4401e08f02158c28ce88ab904b9583aeaeaef0f075cf48a0a581d2cae42df92bc9feb4349f010206

Download Submit
memory/3232-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

Filesize
4KB

Download
memory/3232-1-0x00000000002A0000-0x0000000000308000-memory.dmp

Filesize
416KB

Download
memory/3232-10-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/3232-21-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4716-14-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4716-12-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4716-13-0x0000000004A80000-0x0000000004B12000-memory.dmp

Filesize
584KB

Download
memory/4716-8-0x0000000000500000-0x0000000000550000-memory.dmp

Filesize
320KB

Download
memory/4716-15-0x0000000004A30000-0x0000000004A3A000-memory.dmp

Filesize
40KB

Download
memory/4716-16-0x0000000005C00000-0x0000000006218000-memory.dmp

Filesize
6.1MB

Download
memory/4716-18-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/4716-19-0x0000000004E50000-0x0000000004E8C000-memory.dmp

Filesize
240KB

Download
memory/4716-17-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

Filesize
1.0MB

Download
memory/4716-20-0x0000000004FD0000-0x000000000501C000-memory.dmp

Filesize
304KB

Download
memory/4716-11-0x0000000005030000-0x00000000055D4000-memory.dmp

Filesize
5.6MB

Download
memory/4716-22-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads