redline | 98debd3c3f4b58905b927d6da181e996823b9e7a2f38824eef7787649aca1b19

Analysis

max time kernel
149s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0682a9f5123addd86cb7f295c67ab518.exe
Size

260KB
MD5

0682a9f5123addd86cb7f295c67ab518
SHA1

ca32ad01e5fdfeb1b6cba24d1cabf55d6b4c63f1
SHA256

98debd3c3f4b58905b927d6da181e996823b9e7a2f38824eef7787649aca1b19
SHA512

918b9f99640012e6e70083419a631217efe51a50d39e61e547e92b2be1a04badff698630c6bd931e7191465634b6177b2e8be86ce1c75abb67aadaed94ca866b
SSDEEP

6144:nacUZ1tmz14i+fpJjWWEUQGm55yQPYYu/xuXfgi:MZ/HDoR53wYSxIfgi

Score

10^/10

redline sectoprat eu infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

tstamore.info:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2868-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2868-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2868-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2868-11-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_redline
behavioral1/memory/2868-13-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2868-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2868-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2868-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2868-11-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_sectoprat
behavioral1/memory/2868-13-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 108 set thread context of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	108	0682a9f5123addd86cb7f295c67ab518.exe
Token: SeDebugPrivilege	2868	0682a9f5123addd86cb7f295c67ab518.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28
PID 108 wrote to memory of 2868	108	0682a9f5123addd86cb7f295c67ab518.exe	28

C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe
"C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe
  C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-0-0x00000000010D0000-0x0000000001114000-memory.dmp

Filesize
272KB

Download
memory/108-1-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/108-2-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/108-3-0x00000000002E0000-0x0000000000300000-memory.dmp

Filesize
128KB

Download
memory/108-6-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2868-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2868-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2868-10-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2868-11-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2868-12-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-13-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download