redline | c957609147be9600ae8ecf2a977bfd8ae9eb1a8dfa0c4f303be0636ebd518156 | Triage

Resubmissions

29-06-2024 12:53

240629-p4n3vs1bnp 10

29-06-2024 12:49

240629-p2sm9sxgjf 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 12:49

Sharing

Report Analysis Logs

General

Target

modest-menu.exe
Size

512KB
MD5

95615078a0eb33b1c7bcaa420550c44e
SHA1

9009ebd7a01c84a4637d06fd16be33cbb8dc2b61
SHA256

c957609147be9600ae8ecf2a977bfd8ae9eb1a8dfa0c4f303be0636ebd518156
SHA512

bff7428847a5d57d6a6229aa5442384b07df2d6a3ce0bf9d9a859232106845d3c3764a5d9dd1c2d7d16dda4f414636039f513d097947975538e9a5c2544e6d02
SSDEEP

12288:kKFfKsLIh/4h7TqZFjLb6A4OgyVUrFuma1HwTAT36Z/xZWb/GG:k8iP/EPqZFvb6A4xuGMTKWO

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2760-0-0x0000000000120000-0x00000000001A3000-memory.dmp family_redline
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2368 2760 WerFault.exe modest-menu.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

modest-menu.exe

description	pid	process	target process
PID 2760 wrote to memory of 2368	2760	modest-menu.exe	WerFault.exe
PID 2760 wrote to memory of 2368	2760	modest-menu.exe	WerFault.exe
PID 2760 wrote to memory of 2368	2760	modest-menu.exe	WerFault.exe
PID 2760 wrote to memory of 2368	2760	modest-menu.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\modest-menu.exe
"C:\Users\Admin\AppData\Local\Temp\modest-menu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 96
2⤵
- Program crash
PID:2368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x0000000000120000-0x00000000001A3000-memory.dmp

Filesize
524KB

Download