redline | 869d66bc12e637ac1050f8b2d5c48fefe370b551944cf47ba40e0ec382a673ff

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 03:35

Target

c085f044947d49c84aabd4aa3602bdf4.exe
Size

337KB
MD5

c085f044947d49c84aabd4aa3602bdf4
SHA1

be765b3452cca369848826cefa9d41ddabcdab6a
SHA256

869d66bc12e637ac1050f8b2d5c48fefe370b551944cf47ba40e0ec382a673ff
SHA512

61a6e45fbbe38ab42c05695d7d3c07e3cfcac3085eafbee90f04761d75d2c3a9d7ca9a1d3c760d70b0f9deeb24d956ae9ac45eae71cfa8183adf464a91921ad4
SSDEEP

6144:bmCNITOQaQo9P7sX8fv0sowRncun3Zg6AfiwBPAnpQx5AH:bfOyDL94X8n0sow9cu3LhwBPAi

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-5-0x00000000020E0000-0x0000000002100000-memory.dmp	family_redline
behavioral1/memory/1724-8-0x00000000022A0000-0x00000000022BE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-5-0x00000000020E0000-0x0000000002100000-memory.dmp	family_sectoprat
behavioral1/memory/1724-8-0x00000000022A0000-0x00000000022BE000-memory.dmp	family_sectoprat
behavioral1/memory/1724-9-0x0000000004E20000-0x0000000004E60000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c085f044947d49c84aabd4aa3602bdf4.exe

description pid process

Token: SeDebugPrivilege 1724 c085f044947d49c84aabd4aa3602bdf4.exe

description	pid	process
Token: SeDebugPrivilege	1724	c085f044947d49c84aabd4aa3602bdf4.exe

C:\Users\Admin\AppData\Local\Temp\c085f044947d49c84aabd4aa3602bdf4.exe
"C:\Users\Admin\AppData\Local\Temp\c085f044947d49c84aabd4aa3602bdf4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

memory/1724-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/1724-2-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/1724-3-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/1724-4-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-7-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1724-6-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1724-5-0x00000000020E0000-0x0000000002100000-memory.dmp

Filesize
128KB

Download
memory/1724-8-0x00000000022A0000-0x00000000022BE000-memory.dmp

Filesize
120KB

Download
memory/1724-9-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1724-11-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/1724-12-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/1724-13-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1724-15-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download