redline | c461d436a0a2da6d2e136a6b543b0714b10c5f4b2cd7e5b0c410b9199abdf682

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2024 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6043a451fd0e33a92deba02569d6d086.exe
Size

308KB
MD5

6043a451fd0e33a92deba02569d6d086
SHA1

c544997f23bc3a873fe174539c67bba33646239b
SHA256

c461d436a0a2da6d2e136a6b543b0714b10c5f4b2cd7e5b0c410b9199abdf682
SHA512

a0d446a94b3f3e61e3fe9af4d5f5513f2510f76156dcd2d2ce2022bd34db2e45cd8b0534072a2f7d08e84e25db54dbd81c3410837a017e345ef23ca5d2b3afaf
SSDEEP

6144:Hw+w/agUs1rWEVChPoH+h/gNadN1EEKFbmAnRwoOLtg6:Hw+QomnZ+N1EhFyARwoOhg6

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2524-5-0x0000000004C90000-0x0000000004CB0000-memory.dmp	family_redline
behavioral2/memory/2524-9-0x0000000004D70000-0x0000000004D8E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2524-5-0x0000000004C90000-0x0000000004CB0000-memory.dmp	family_sectoprat
behavioral2/memory/2524-7-0x0000000004B00000-0x0000000004B10000-memory.dmp	family_sectoprat
behavioral2/memory/2524-9-0x0000000004D70000-0x0000000004D8E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6043a451fd0e33a92deba02569d6d086.exe

description pid process

Token: SeDebugPrivilege 2524 6043a451fd0e33a92deba02569d6d086.exe

description	pid	process
Token: SeDebugPrivilege	2524	6043a451fd0e33a92deba02569d6d086.exe

C:\Users\Admin\AppData\Local\Temp\6043a451fd0e33a92deba02569d6d086.exe
"C:\Users\Admin\AppData\Local\Temp\6043a451fd0e33a92deba02569d6d086.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-1-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Filesize
1024KB

Download
memory/2524-2-0x0000000002E30000-0x0000000002E5F000-memory.dmp

Filesize
188KB

Download
memory/2524-3-0x0000000000400000-0x0000000002C83000-memory.dmp

Filesize
40.5MB

Download
memory/2524-4-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/2524-5-0x0000000004C90000-0x0000000004CB0000-memory.dmp

Filesize
128KB

Download
memory/2524-6-0x0000000000400000-0x0000000002C83000-memory.dmp

Filesize
40.5MB

Download
memory/2524-7-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2524-8-0x0000000007450000-0x00000000079F4000-memory.dmp

Filesize
5.6MB

Download
memory/2524-9-0x0000000004D70000-0x0000000004D8E000-memory.dmp

Filesize
120KB

Download
memory/2524-10-0x0000000007A00000-0x0000000008018000-memory.dmp

Filesize
6.1MB

Download
memory/2524-11-0x0000000004F40000-0x0000000004F52000-memory.dmp

Filesize
72KB

Download
memory/2524-12-0x0000000008020000-0x000000000805C000-memory.dmp

Filesize
240KB

Download
memory/2524-13-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2524-14-0x0000000008080000-0x00000000080CC000-memory.dmp

Filesize
304KB

Download
memory/2524-15-0x0000000008210000-0x000000000831A000-memory.dmp

Filesize
1.0MB

Download
memory/2524-17-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Filesize
1024KB

Download
memory/2524-18-0x0000000002E30000-0x0000000002E5F000-memory.dmp

Filesize
188KB

Download
memory/2524-20-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/2524-21-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2524-22-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2524-24-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download