redline | 2e9188953414bcf2fd4a93d2498b323118d58c96605b7f7d71947981f5972dcf

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:37

Target

0885cc53024d2d9f56a2817c5f3fd81f.exe
Size

305KB
MD5

0885cc53024d2d9f56a2817c5f3fd81f
SHA1

2a4181b1153c280278414de5de4a3b5ef3faa93c
SHA256

2e9188953414bcf2fd4a93d2498b323118d58c96605b7f7d71947981f5972dcf
SHA512

4d3884875538735d9d5f7fb1fd262bcb92aced7b8462d8fd1447063e5df1bc57127c1ccc11cf113274236a0e3aa1597de9053fe4710e4f52747bada42c3f111f
SSDEEP

6144:AtKfoT5Ih9ay6oIui9/+9IiYqmJG0WlYtBuUXb84PP:3foNIhQyIuUm9OqoWyB3b84X

Score

10^/10

Family

redline

Botnet

170

147.124.222.75:42864

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3016-5-0x0000000000390000-0x00000000003B0000-memory.dmp	family_redline
behavioral1/memory/3016-8-0x0000000000480000-0x000000000049E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3016-5-0x0000000000390000-0x00000000003B0000-memory.dmp	family_sectoprat
behavioral1/memory/3016-8-0x0000000000480000-0x000000000049E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0885cc53024d2d9f56a2817c5f3fd81f.exe

description pid process

Token: SeDebugPrivilege 3016 0885cc53024d2d9f56a2817c5f3fd81f.exe

description	pid	process
Token: SeDebugPrivilege	3016	0885cc53024d2d9f56a2817c5f3fd81f.exe

C:\Users\Admin\AppData\Local\Temp\0885cc53024d2d9f56a2817c5f3fd81f.exe
"C:\Users\Admin\AppData\Local\Temp\0885cc53024d2d9f56a2817c5f3fd81f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016

memory/3016-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/3016-1-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/3016-3-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3016-6-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/3016-5-0x0000000000390000-0x00000000003B0000-memory.dmp

Filesize
128KB

Download
memory/3016-4-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/3016-7-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/3016-8-0x0000000000480000-0x000000000049E000-memory.dmp

Filesize
120KB

Download
memory/3016-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3016-10-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/3016-11-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/3016-12-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/3016-13-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download