redline | a23d1f07dfef6b5fda6381ecf6866746d624dbc1e510073d83f431124bf7d556

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 08:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75d4b2f64dde3fc89adf5c39891111af.exe
Size

913KB
MD5

75d4b2f64dde3fc89adf5c39891111af
SHA1

cad9e02a08dda87d0e2b88ac3c96ce1b1de5740e
SHA256

a23d1f07dfef6b5fda6381ecf6866746d624dbc1e510073d83f431124bf7d556
SHA512

462f1de721d5005b0d89168f7b5b1937b7b16f0edf99430104a60505b33a65eaf02f03b36b839e1b5633bc45eaf9f03bd5ccff121e7302f431d263a99d586203
SSDEEP

24576:v4TiFiWXYwSv6ZNuzcB3mNO0Uoq0NDQDd:v4gbM0+k8p60Kd

Score

10^/10

redline foz infostealer

Malware Config

Extracted

Family

redline

Botnet

foz

147.45.45.3:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/1472-10-0x0000000000400000-0x0000000000452000-memory.dmp family_redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

75d4b2f64dde3fc89adf5c39891111af.exe

description pid process target process

PID 4624 set thread context of 1472 4624 75d4b2f64dde3fc89adf5c39891111af.exe 75d4b2f64dde3fc89adf5c39891111af.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

75d4b2f64dde3fc89adf5c39891111af.exe

pid process

4624 75d4b2f64dde3fc89adf5c39891111af.exe
4624 75d4b2f64dde3fc89adf5c39891111af.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75d4b2f64dde3fc89adf5c39891111af.exe

description pid process

Token: SeDebugPrivilege 4624 75d4b2f64dde3fc89adf5c39891111af.exe

resource	yara_rule
behavioral2/memory/1472-10-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

description	pid	process	target process
PID 4624 set thread context of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe

pid	process
4624	75d4b2f64dde3fc89adf5c39891111af.exe
4624	75d4b2f64dde3fc89adf5c39891111af.exe

description	pid	process
Token: SeDebugPrivilege	4624	75d4b2f64dde3fc89adf5c39891111af.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

75d4b2f64dde3fc89adf5c39891111af.exe

description	pid	process	target process
PID 4624 wrote to memory of 3660	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 3660	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 3660	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe
PID 4624 wrote to memory of 1472	4624	75d4b2f64dde3fc89adf5c39891111af.exe	75d4b2f64dde3fc89adf5c39891111af.exe

C:\Users\Admin\AppData\Local\Temp\75d4b2f64dde3fc89adf5c39891111af.exe
"C:\Users\Admin\AppData\Local\Temp\75d4b2f64dde3fc89adf5c39891111af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624

C:\Users\Admin\AppData\Local\Temp\75d4b2f64dde3fc89adf5c39891111af.exe
"C:\Users\Admin\AppData\Local\Temp\75d4b2f64dde3fc89adf5c39891111af.exe"
2⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\75d4b2f64dde3fc89adf5c39891111af.exe
"C:\Users\Admin\AppData\Local\Temp\75d4b2f64dde3fc89adf5c39891111af.exe"
2⤵
PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\75d4b2f64dde3fc89adf5c39891111af.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1472-16-0x0000000006A70000-0x0000000007088000-memory.dmp

Filesize
6.1MB

Download
memory/1472-15-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/1472-20-0x0000000005B90000-0x0000000005BDC000-memory.dmp

Filesize
304KB

Download
memory/1472-18-0x0000000005AE0000-0x0000000005AF2000-memory.dmp

Filesize
72KB

Download
memory/1472-17-0x0000000005C20000-0x0000000005D2A000-memory.dmp

Filesize
1.0MB

Download
memory/1472-14-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/1472-19-0x0000000005B40000-0x0000000005B7C000-memory.dmp

Filesize
240KB

Download
memory/1472-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1472-21-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/4624-7-0x0000000006B00000-0x0000000006B0C000-memory.dmp

Filesize
48KB

Download
memory/4624-8-0x0000000006E10000-0x0000000006EA4000-memory.dmp

Filesize
592KB

Download
memory/4624-13-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/4624-6-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/4624-2-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/4624-0-0x0000000074E3E000-0x0000000074E3F000-memory.dmp

Filesize
4KB

Download
memory/4624-5-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/4624-4-0x0000000005460000-0x000000000546A000-memory.dmp

Filesize
40KB

Download
memory/4624-1-0x0000000000960000-0x0000000000A4A000-memory.dmp

Filesize
936KB

Download
memory/4624-3-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/4624-9-0x0000000006C50000-0x0000000006CEC000-memory.dmp

Filesize
624KB

Download