redline | c461d436a0a2da6d2e136a6b543b0714b10c5f4b2cd7e5b0c410b9199abdf682

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-01-2024 15:45

Target

6043a451fd0e33a92deba02569d6d086.exe
Size

308KB
MD5

6043a451fd0e33a92deba02569d6d086
SHA1

c544997f23bc3a873fe174539c67bba33646239b
SHA256

c461d436a0a2da6d2e136a6b543b0714b10c5f4b2cd7e5b0c410b9199abdf682
SHA512

a0d446a94b3f3e61e3fe9af4d5f5513f2510f76156dcd2d2ce2022bd34db2e45cd8b0534072a2f7d08e84e25db54dbd81c3410837a017e345ef23ca5d2b3afaf
SSDEEP

6144:Hw+w/agUs1rWEVChPoH+h/gNadN1EEKFbmAnRwoOLtg6:Hw+QomnZ+N1EhFyARwoOhg6

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/804-3-0x0000000002D70000-0x0000000002D90000-memory.dmp	family_redline
behavioral1/memory/804-6-0x0000000006FB0000-0x0000000006FF0000-memory.dmp	family_redline
behavioral1/memory/804-4-0x00000000046E0000-0x00000000046FE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/804-3-0x0000000002D70000-0x0000000002D90000-memory.dmp	family_sectoprat
behavioral1/memory/804-6-0x0000000006FB0000-0x0000000006FF0000-memory.dmp	family_sectoprat
behavioral1/memory/804-4-0x00000000046E0000-0x00000000046FE000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6043a451fd0e33a92deba02569d6d086.exe

description pid process

Token: SeDebugPrivilege 804 6043a451fd0e33a92deba02569d6d086.exe

description	pid	process
Token: SeDebugPrivilege	804	6043a451fd0e33a92deba02569d6d086.exe

C:\Users\Admin\AppData\Local\Temp\6043a451fd0e33a92deba02569d6d086.exe
"C:\Users\Admin\AppData\Local\Temp\6043a451fd0e33a92deba02569d6d086.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:804

memory/804-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/804-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

Filesize
1024KB

Download
memory/804-3-0x0000000002D70000-0x0000000002D90000-memory.dmp

Filesize
128KB

Download
memory/804-8-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

Filesize
256KB

Download
memory/804-7-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

Filesize
256KB

Download
memory/804-6-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

Filesize
256KB

Download
memory/804-5-0x0000000000400000-0x0000000002C83000-memory.dmp

Filesize
40.5MB

Download
memory/804-4-0x00000000046E0000-0x00000000046FE000-memory.dmp

Filesize
120KB

Download
memory/804-9-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/804-14-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

Filesize
256KB

Download
memory/804-13-0x0000000006FB0000-0x0000000006FF0000-memory.dmp

Filesize
256KB

Download
memory/804-12-0x0000000002D90000-0x0000000002E90000-memory.dmp

Filesize
1024KB

Download
memory/804-15-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download