redline | 1dfd369a1525add9e113444ea99f88fcf0eb2b5228079d3747dc1dedd05aeb8e

Analysis

max time kernel
53s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 02:57

Target

CrackedSony_Vegas.exe
Size

512KB
MD5

d016d5420cb03bfaa4241fa58c0da051
SHA1

c679a55514a1cf8b1e6597d5fa2f3967e2c852ac
SHA256

1dfd369a1525add9e113444ea99f88fcf0eb2b5228079d3747dc1dedd05aeb8e
SHA512

648de2b28d3683ad96cade02aeaaf261e4d2c394a8018a173e2411b5c5ce120605853588c82c2aa98ea6f1679bc53dfbd5ff48ea4dcd811df53b2ee7b5e43613
SSDEEP

12288:hZAzp54v/8/yqMea43KK+nxJrxydVEqdv0NVqbQpeIdi:h4O/8aqMTaXUnCv0NV0Qpl

Score

10^/10

Family

redline

Botnet

@xcdaxfszx

94.228.166.68:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1072-0-0x0000000000400000-0x0000000000450000-memory.dmp family_redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

CrackedSony_Vegas.exe

description pid process target process

PID 3548 set thread context of 1072 3548 CrackedSony_Vegas.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1804 3548 WerFault.exe CrackedSony_Vegas.exe

resource	yara_rule
behavioral1/memory/1072-0-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

description	pid	process	target process
PID 3548 set thread context of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe

pid	pid_target	process	target process
1804	3548	WerFault.exe	CrackedSony_Vegas.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

CrackedSony_Vegas.exe

description	pid	process	target process
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe
PID 3548 wrote to memory of 1072	3548	CrackedSony_Vegas.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 308
2⤵
- Program crash
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3548 -ip 3548
1⤵
PID:1468

memory/1072-6-0x00000000743B0000-0x0000000074B60000-memory.dmp

Filesize
7.7MB

Download
memory/1072-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1072-2-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/1072-3-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/1072-4-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/1072-5-0x00000000056D0000-0x00000000056DA000-memory.dmp

Filesize
40KB

Download
memory/1072-13-0x00000000743B0000-0x0000000074B60000-memory.dmp

Filesize
7.7MB

Download
memory/1072-7-0x0000000006B30000-0x0000000007148000-memory.dmp

Filesize
6.1MB

Download
memory/1072-10-0x00000000083D0000-0x000000000840C000-memory.dmp

Filesize
240KB

Download
memory/1072-9-0x00000000083B0000-0x00000000083C2000-memory.dmp

Filesize
72KB

Download
memory/1072-8-0x00000000084C0000-0x00000000085CA000-memory.dmp

Filesize
1.0MB

Download
memory/1072-11-0x0000000008450000-0x000000000849C000-memory.dmp

Filesize
304KB

Download
memory/1072-12-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/3548-1-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download