Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 14:57
Behavioral task
behavioral1
Sample
59011b30630b327f21b0c6c070e6bdc3.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
59011b30630b327f21b0c6c070e6bdc3.exe
-
Size
100KB
-
MD5
59011b30630b327f21b0c6c070e6bdc3
-
SHA1
b66bb460126a2341c13b4bd8aa9c75062eddc0c2
-
SHA256
b25de8622f43e2beb203e0e394906bd6832f95277f53c4dbd59d4afbcef7b361
-
SHA512
3ee47b6351ead753f3edc1eadb41a6d6001c0dd0121b7d29c887b5d4139c49cdea2bacf5ad142abd63d3f893bb6c9968e1b25616f61f04fa92174ee699cfa655
-
SSDEEP
1536:Wo6aGLKCzK2ZHMkDK2e9oZPFauhwPgbue7v5ujNyAsdgnetx5REPG6WAaoigm:WdxGCzh30uv35uxyddjNWlW
Malware Config
Extracted
Family
redline
Botnet
installs2
C2
65.21.228.92:46802
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/2024-0-0x0000000000100000-0x000000000011E000-memory.dmp family_redline behavioral1/memory/2024-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
resource yara_rule behavioral1/memory/2024-0-0x0000000000100000-0x000000000011E000-memory.dmp family_sectoprat behavioral1/memory/2024-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp family_sectoprat -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2024 59011b30630b327f21b0c6c070e6bdc3.exe