redline | c328376ed751586f0d86827a946524a8e719d87108bb705438b526d2bc744692

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 08:24

Target

d2975b772607416e9d071e204d056ef6.exe
Size

337KB
MD5

d2975b772607416e9d071e204d056ef6
SHA1

3e281eb9fa1896ed9813d7e972e04b8605200d70
SHA256

c328376ed751586f0d86827a946524a8e719d87108bb705438b526d2bc744692
SHA512

7585ebaba87490e9d5009a8560dd2d3d68060ae4729100465943d65075edfd4cf2dbe62444d411396d36027ebb3d0fc477451b7734daae87fe53b282790831ca
SSDEEP

3072:FGhGmI2EWhybPQVwAw/jo79KgByDsoVKuTOBLX1JTqlF8TaaLyRYdI0FtA9p70Bp:5mTyb4hcjo0gEPuLHq4PBPAnpQx5AH

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3040-8-0x00000000009A0000-0x00000000009BE000-memory.dmp	family_redline
behavioral1/memory/3040-4-0x0000000000910000-0x0000000000930000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3040-8-0x00000000009A0000-0x00000000009BE000-memory.dmp	family_sectoprat
behavioral1/memory/3040-4-0x0000000000910000-0x0000000000930000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d2975b772607416e9d071e204d056ef6.exe

description pid process

Token: SeDebugPrivilege 3040 d2975b772607416e9d071e204d056ef6.exe

description	pid	process
Token: SeDebugPrivilege	3040	d2975b772607416e9d071e204d056ef6.exe

C:\Users\Admin\AppData\Local\Temp\d2975b772607416e9d071e204d056ef6.exe
"C:\Users\Admin\AppData\Local\Temp\d2975b772607416e9d071e204d056ef6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040

memory/3040-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/3040-3-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/3040-7-0x0000000000BD0000-0x0000000000C10000-memory.dmp

Filesize
256KB

Download
memory/3040-8-0x00000000009A0000-0x00000000009BE000-memory.dmp

Filesize
120KB

Download
memory/3040-6-0x0000000000BD0000-0x0000000000C10000-memory.dmp

Filesize
256KB

Download
memory/3040-5-0x0000000073E50000-0x000000007453E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-4-0x0000000000910000-0x0000000000930000-memory.dmp

Filesize
128KB

Download
memory/3040-1-0x00000000009D0000-0x0000000000AD0000-memory.dmp

Filesize
1024KB

Download
memory/3040-10-0x00000000009D0000-0x0000000000AD0000-memory.dmp

Filesize
1024KB

Download
memory/3040-11-0x0000000073E50000-0x000000007453E000-memory.dmp

Filesize
6.9MB

Download