redline | caf928c92c82bec4fbef87970f963238226ab3694fae66f309d43d6eb35ab632

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 04:40

Target

5a4f1e455ad61e6cb8faf3784d1b26c9.exe
Size

350KB
MD5

5a4f1e455ad61e6cb8faf3784d1b26c9
SHA1

a1d205d570e43b5d10a7fa3f1212428e2a90f1c0
SHA256

caf928c92c82bec4fbef87970f963238226ab3694fae66f309d43d6eb35ab632
SHA512

b49d8c5d4e6f8c1eebce9fbf75e3440dc1ca1cf261543e287eccfc0f3967d79d2458b6be6aae3657f9caceeabbff205e7835a3309e637cf804187c7d3076c9c8
SSDEEP

6144:L3XdgDUvUsv0gODVXS+EkN7m193LKUd2ZrNVfs8V:BmyUsvMRTHN7m1rd8N2

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-3-0x0000000004590000-0x00000000045B0000-memory.dmp	family_redline
behavioral1/memory/1940-4-0x00000000048C0000-0x00000000048DE000-memory.dmp	family_redline
behavioral1/memory/1940-6-0x00000000070B0000-0x00000000070F0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-3-0x0000000004590000-0x00000000045B0000-memory.dmp	family_sectoprat
behavioral1/memory/1940-4-0x00000000048C0000-0x00000000048DE000-memory.dmp	family_sectoprat
behavioral1/memory/1940-6-0x00000000070B0000-0x00000000070F0000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5a4f1e455ad61e6cb8faf3784d1b26c9.exe

description pid process

Token: SeDebugPrivilege 1940 5a4f1e455ad61e6cb8faf3784d1b26c9.exe

description	pid	process
Token: SeDebugPrivilege	1940	5a4f1e455ad61e6cb8faf3784d1b26c9.exe

C:\Users\Admin\AppData\Local\Temp\5a4f1e455ad61e6cb8faf3784d1b26c9.exe
"C:\Users\Admin\AppData\Local\Temp\5a4f1e455ad61e6cb8faf3784d1b26c9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940

memory/1940-1-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/1940-2-0x00000000003A0000-0x00000000003CF000-memory.dmp

Filesize
188KB

Download
memory/1940-3-0x0000000004590000-0x00000000045B0000-memory.dmp

Filesize
128KB

Download
memory/1940-4-0x00000000048C0000-0x00000000048DE000-memory.dmp

Filesize
120KB

Download
memory/1940-5-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/1940-6-0x00000000070B0000-0x00000000070F0000-memory.dmp

Filesize
256KB

Download
memory/1940-7-0x00000000070B0000-0x00000000070F0000-memory.dmp

Filesize
256KB

Download
memory/1940-8-0x00000000070B0000-0x00000000070F0000-memory.dmp

Filesize
256KB

Download
memory/1940-9-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-11-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/1940-13-0x00000000070B0000-0x00000000070F0000-memory.dmp

Filesize
256KB

Download
memory/1940-12-0x00000000070B0000-0x00000000070F0000-memory.dmp

Filesize
256KB

Download
memory/1940-15-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download