redline | 7718672da6bc8e4a147601cac94d5ad8a874a864d473780b525f2d858730378c

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 08:41

Target

2f6665f46da4efc64a049d781f416f62.exe
Size

310KB
MD5

2f6665f46da4efc64a049d781f416f62
SHA1

be21b9172c7f3fd1fc889cebc598bb818ae18bb1
SHA256

7718672da6bc8e4a147601cac94d5ad8a874a864d473780b525f2d858730378c
SHA512

ac161b975b9902e771bf43e4a052b12b630ae71b17df84d4f7188e19552e065e46e06c76f40e1263e807b287a7b2ddb836aa77aa49ad43271ea0662b7ea19242
SSDEEP

3072:y19tAx9rj/6Txm/ifxvuOCTIi57lNWVjwsdleDaz4zarilqn5n441hR+CI014ygn:swj/GmG/q5yVflZr6qB4hzOiJLXBPAn

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2148-4-0x0000000000380000-0x00000000003A0000-memory.dmp	family_redline
behavioral1/memory/2148-6-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_redline
behavioral1/memory/2148-8-0x0000000000900000-0x000000000091E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2148-4-0x0000000000380000-0x00000000003A0000-memory.dmp	family_sectoprat
behavioral1/memory/2148-6-0x0000000004DC0000-0x0000000004E00000-memory.dmp	family_sectoprat
behavioral1/memory/2148-8-0x0000000000900000-0x000000000091E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2f6665f46da4efc64a049d781f416f62.exe

description pid process

Token: SeDebugPrivilege 2148 2f6665f46da4efc64a049d781f416f62.exe

description	pid	process
Token: SeDebugPrivilege	2148	2f6665f46da4efc64a049d781f416f62.exe

C:\Users\Admin\AppData\Local\Temp\2f6665f46da4efc64a049d781f416f62.exe
"C:\Users\Admin\AppData\Local\Temp\2f6665f46da4efc64a049d781f416f62.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

memory/2148-1-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/2148-2-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/2148-3-0x0000000000400000-0x00000000008B7000-memory.dmp

Filesize
4.7MB

Download
memory/2148-4-0x0000000000380000-0x00000000003A0000-memory.dmp

Filesize
128KB

Download
memory/2148-5-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-6-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2148-7-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2148-8-0x0000000000900000-0x000000000091E000-memory.dmp

Filesize
120KB

Download
memory/2148-9-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/2148-11-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download