redline | 66fff084975782cddb02df98a9cab04e2af1b489d7d8bb17ae7e0ffc30e706be

Analysis

max time kernel
160s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fce56ea69a9712ce0ac94368d5a124b0.exe
Size

386KB
MD5

fce56ea69a9712ce0ac94368d5a124b0
SHA1

13906015b834bfe7140da50f9d12733408677006
SHA256

66fff084975782cddb02df98a9cab04e2af1b489d7d8bb17ae7e0ffc30e706be
SHA512

639b96c438bf84ddaeab979fc7b81de3f8b2b10a1d5f119365a83a60103b6ddb69d96228ebeda7c950d08370dd0057b841d9f527c8f5bb05e5de84d9f253d0af
SSDEEP

6144:vGBYycejKQKCSBQPRfVs74jPleTWM1iARZajJRfjzMLUASz6evAK+Gijy:ZLejtRSCPLs0bAPTRZEfnzbvY2

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2260-5-0x00000000021E0000-0x0000000002200000-memory.dmp	family_redline
behavioral2/memory/2260-10-0x0000000002520000-0x000000000253E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2260-5-0x00000000021E0000-0x0000000002200000-memory.dmp	family_sectoprat
behavioral2/memory/2260-7-0x0000000004C10000-0x0000000004C20000-memory.dmp	family_sectoprat
behavioral2/memory/2260-10-0x0000000002520000-0x000000000253E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fce56ea69a9712ce0ac94368d5a124b0.exe

description pid process

Token: SeDebugPrivilege 2260 fce56ea69a9712ce0ac94368d5a124b0.exe

description	pid	process
Token: SeDebugPrivilege	2260	fce56ea69a9712ce0ac94368d5a124b0.exe

C:\Users\Admin\AppData\Local\Temp\fce56ea69a9712ce0ac94368d5a124b0.exe
"C:\Users\Admin\AppData\Local\Temp\fce56ea69a9712ce0ac94368d5a124b0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-1-0x00000000007D0000-0x00000000008D0000-memory.dmp

Filesize
1024KB

Download
memory/2260-2-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2260-3-0x00000000006E0000-0x000000000070F000-memory.dmp

Filesize
188KB

Download
memory/2260-4-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2260-5-0x00000000021E0000-0x0000000002200000-memory.dmp

Filesize
128KB

Download
memory/2260-6-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2260-7-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2260-8-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2260-9-0x0000000004C20000-0x00000000051C4000-memory.dmp

Filesize
5.6MB

Download
memory/2260-10-0x0000000002520000-0x000000000253E000-memory.dmp

Filesize
120KB

Download
memory/2260-11-0x00000000051D0000-0x00000000057E8000-memory.dmp

Filesize
6.1MB

Download
memory/2260-12-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

Filesize
72KB

Download
memory/2260-13-0x0000000004AF0000-0x0000000004B2C000-memory.dmp

Filesize
240KB

Download
memory/2260-14-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2260-15-0x0000000004B50000-0x0000000004B9C000-memory.dmp

Filesize
304KB

Download
memory/2260-16-0x00000000058C0000-0x00000000059CA000-memory.dmp

Filesize
1.0MB

Download
memory/2260-17-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2260-18-0x00000000007D0000-0x00000000008D0000-memory.dmp

Filesize
1024KB

Download
memory/2260-19-0x00000000006E0000-0x000000000070F000-memory.dmp

Filesize
188KB

Download
memory/2260-21-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2260-22-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2260-23-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2260-24-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/2260-25-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download