redline | 869d66bc12e637ac1050f8b2d5c48fefe370b551944cf47ba40e0ec382a673ff

Analysis

max time kernel
163s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c085f044947d49c84aabd4aa3602bdf4.exe
Size

337KB
MD5

c085f044947d49c84aabd4aa3602bdf4
SHA1

be765b3452cca369848826cefa9d41ddabcdab6a
SHA256

869d66bc12e637ac1050f8b2d5c48fefe370b551944cf47ba40e0ec382a673ff
SHA512

61a6e45fbbe38ab42c05695d7d3c07e3cfcac3085eafbee90f04761d75d2c3a9d7ca9a1d3c760d70b0f9deeb24d956ae9ac45eae71cfa8183adf464a91921ad4
SSDEEP

6144:bmCNITOQaQo9P7sX8fv0sowRncun3Zg6AfiwBPAnpQx5AH:bfOyDL94X8n0sow9cu3LhwBPAi

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4104-12-0x00000000028A0000-0x00000000028C0000-memory.dmp	family_redline
behavioral2/memory/4104-19-0x0000000000BF0000-0x0000000000C0E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4104-12-0x00000000028A0000-0x00000000028C0000-memory.dmp	family_sectoprat
behavioral2/memory/4104-19-0x0000000000BF0000-0x0000000000C0E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c085f044947d49c84aabd4aa3602bdf4.exe

description pid process

Token: SeDebugPrivilege 4104 c085f044947d49c84aabd4aa3602bdf4.exe

description	pid	process
Token: SeDebugPrivilege	4104	c085f044947d49c84aabd4aa3602bdf4.exe

C:\Users\Admin\AppData\Local\Temp\c085f044947d49c84aabd4aa3602bdf4.exe
"C:\Users\Admin\AppData\Local\Temp\c085f044947d49c84aabd4aa3602bdf4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4104-1-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/4104-2-0x0000000002610000-0x000000000263F000-memory.dmp

Filesize
188KB

Download
memory/4104-3-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/4104-4-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/4104-5-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/4104-6-0x0000000000A30000-0x0000000000B30000-memory.dmp

Filesize
1024KB

Download
memory/4104-8-0x0000000002610000-0x000000000263F000-memory.dmp

Filesize
188KB

Download
memory/4104-9-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/4104-11-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-12-0x00000000028A0000-0x00000000028C0000-memory.dmp

Filesize
128KB

Download
memory/4104-14-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/4104-15-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-16-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-18-0x0000000005110000-0x00000000056B4000-memory.dmp

Filesize
5.6MB

Download
memory/4104-19-0x0000000000BF0000-0x0000000000C0E000-memory.dmp

Filesize
120KB

Download
memory/4104-20-0x00000000057C0000-0x0000000005DD8000-memory.dmp

Filesize
6.1MB

Download
memory/4104-21-0x0000000002930000-0x0000000002942000-memory.dmp

Filesize
72KB

Download
memory/4104-23-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-24-0x0000000002990000-0x00000000029CC000-memory.dmp

Filesize
240KB

Download
memory/4104-25-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-26-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-27-0x0000000002AE0000-0x0000000002B2C000-memory.dmp

Filesize
304KB

Download
memory/4104-29-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4104-30-0x0000000005E40000-0x0000000005F4A000-memory.dmp

Filesize
1.0MB

Download
memory/4104-33-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download