redline | 637a0494e576015bdbc53a9a3d5efd6ed2cac129facef169a06ed4f2d07188d2

Analysis

max time kernel
143s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 17:26

Target

5da99c33c90f7b6287ec759af919beaa.exe
Size

290KB
MD5

5da99c33c90f7b6287ec759af919beaa
SHA1

41da1c98a57bc043d119a590d9a6577915d1d03b
SHA256

637a0494e576015bdbc53a9a3d5efd6ed2cac129facef169a06ed4f2d07188d2
SHA512

f25b50604ff02e8dce3302d9b32e11a9190a2bafadd1fd0a461bc9ea6a7762743efd02b12e7884f99e90c41c8b0dca4269e3e874721eb74c258e268d010ff3f8
SSDEEP

6144:qp+bAnv2R5e/uUFSUuySKl2JliYFoylAeAwm:qpCAeR5eGESUu9i4qw

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2392-3-0x0000000002E10000-0x0000000002E30000-memory.dmp	family_redline
behavioral1/memory/2392-7-0x00000000030F0000-0x000000000310E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2392-3-0x0000000002E10000-0x0000000002E30000-memory.dmp	family_sectoprat
behavioral1/memory/2392-7-0x00000000030F0000-0x000000000310E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5da99c33c90f7b6287ec759af919beaa.exe

description pid process

Token: SeDebugPrivilege 2392 5da99c33c90f7b6287ec759af919beaa.exe

description	pid	process
Token: SeDebugPrivilege	2392	5da99c33c90f7b6287ec759af919beaa.exe

C:\Users\Admin\AppData\Local\Temp\5da99c33c90f7b6287ec759af919beaa.exe
"C:\Users\Admin\AppData\Local\Temp\5da99c33c90f7b6287ec759af919beaa.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

memory/2392-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2392-1-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/2392-3-0x0000000002E10000-0x0000000002E30000-memory.dmp

Filesize
128KB

Download
memory/2392-4-0x0000000000400000-0x0000000002CD7000-memory.dmp

Filesize
40.8MB

Download
memory/2392-6-0x00000000070F0000-0x0000000007130000-memory.dmp

Filesize
256KB

Download
memory/2392-7-0x00000000030F0000-0x000000000310E000-memory.dmp

Filesize
120KB

Download
memory/2392-5-0x00000000070F0000-0x0000000007130000-memory.dmp

Filesize
256KB

Download
memory/2392-8-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2392-9-0x00000000070F0000-0x0000000007130000-memory.dmp

Filesize
256KB

Download
memory/2392-11-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/2392-13-0x00000000070F0000-0x0000000007130000-memory.dmp

Filesize
256KB

Download
memory/2392-14-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/2392-15-0x00000000070F0000-0x0000000007130000-memory.dmp

Filesize
256KB

Download