redline | f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2023 10:33

Target

03c3f979feffbf02e7ab9a66f9a1f7b4.exe
Size

12KB
MD5

03c3f979feffbf02e7ab9a66f9a1f7b4
SHA1

826e5038b32c3975821eb8641e484b575fdfa7e9
SHA256

f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd
SHA512

14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea
SSDEEP

192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6

Score

10^/10

Family

redline

Botnet

Love Fi Lo

111.90.149.195:55186

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4948-138-0x0000000000590000-0x00000000005AE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4948-138-0x0000000000590000-0x00000000005AE000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

03c3f979feffbf02e7ab9a66f9a1f7b4.exe

description pid process target process

PID 4204 set thread context of 4948 4204 03c3f979feffbf02e7ab9a66f9a1f7b4.exe aspnet_regbrowsers.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

03c3f979feffbf02e7ab9a66f9a1f7b4.exeaspnet_regbrowsers.exe

description pid process

Token: SeDebugPrivilege 4204 03c3f979feffbf02e7ab9a66f9a1f7b4.exe
Token: SeDebugPrivilege 4948 aspnet_regbrowsers.exe

description	pid	process	target process
PID 4204 set thread context of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe

description	pid	process
Token: SeDebugPrivilege	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe
Token: SeDebugPrivilege	4948	aspnet_regbrowsers.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

03c3f979feffbf02e7ab9a66f9a1f7b4.exe

description	pid	process	target process
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe
PID 4204 wrote to memory of 4948	4204	03c3f979feffbf02e7ab9a66f9a1f7b4.exe	aspnet_regbrowsers.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948

memory/4204-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4204-134-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4204-135-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4204-136-0x0000000006AB0000-0x0000000006B4C000-memory.dmp

Filesize
624KB

Download
memory/4948-138-0x0000000000590000-0x00000000005AE000-memory.dmp

Filesize
120KB

Download
memory/4948-139-0x00000000050C0000-0x00000000056D8000-memory.dmp

Filesize
6.1MB

Download
memory/4948-140-0x0000000004A00000-0x0000000004A12000-memory.dmp

Filesize
72KB

Download
memory/4948-141-0x0000000004AA0000-0x0000000004ADC000-memory.dmp

Filesize
240KB

Download
memory/4948-142-0x0000000004A90000-0x0000000004AA0000-memory.dmp

Filesize
64KB

Download
memory/4948-143-0x0000000004D10000-0x0000000004E1A000-memory.dmp

Filesize
1.0MB

Download
memory/4948-144-0x0000000005D70000-0x0000000005F32000-memory.dmp

Filesize
1.8MB

Download
memory/4948-145-0x0000000006470000-0x000000000699C000-memory.dmp

Filesize
5.2MB

Download