redline | ffee20e0c17936875243ac105258abcf77e70001a0e8adc80aedbc5cfa9a7660

Analysis

max time kernel
140s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-01-2024 02:32

Target

61848c2af23b397079ba837c73351458.exe
Size

278KB
MD5

61848c2af23b397079ba837c73351458
SHA1

192cefc63caba42ec30f7568e74c98f17ecdf666
SHA256

ffee20e0c17936875243ac105258abcf77e70001a0e8adc80aedbc5cfa9a7660
SHA512

9fc4d3a2f4bc7cf2698010cac29ee5e9c434a0a13625bd3325651b7afc97fe4c4fa6e258b9e122be74239387d7702e8e52a073b4e643183ec18725668db21aa0
SSDEEP

6144:3LyPUeEx85CSrdNMO+j+56kRbJASdOQ/fzc/mLyIYz:3xL0rnMO+8nwSM7XI

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2420-3-0x0000000004780000-0x00000000047A0000-memory.dmp	family_redline
behavioral1/memory/2420-8-0x00000000047C0000-0x00000000047DE000-memory.dmp	family_redline
behavioral1/memory/2420-10-0x00000000071F0000-0x0000000007230000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2420-3-0x0000000004780000-0x00000000047A0000-memory.dmp	family_sectoprat
behavioral1/memory/2420-8-0x00000000047C0000-0x00000000047DE000-memory.dmp	family_sectoprat
behavioral1/memory/2420-10-0x00000000071F0000-0x0000000007230000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

61848c2af23b397079ba837c73351458.exe

description pid process

Token: SeDebugPrivilege 2420 61848c2af23b397079ba837c73351458.exe

description	pid	process
Token: SeDebugPrivilege	2420	61848c2af23b397079ba837c73351458.exe

C:\Users\Admin\AppData\Local\Temp\61848c2af23b397079ba837c73351458.exe
"C:\Users\Admin\AppData\Local\Temp\61848c2af23b397079ba837c73351458.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420

memory/2420-1-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/2420-2-0x0000000000230000-0x000000000025F000-memory.dmp

Filesize
188KB

Download
memory/2420-3-0x0000000004780000-0x00000000047A0000-memory.dmp

Filesize
128KB

Download
memory/2420-4-0x0000000000400000-0x0000000002CD3000-memory.dmp

Filesize
40.8MB

Download
memory/2420-5-0x00000000071F0000-0x0000000007230000-memory.dmp

Filesize
256KB

Download
memory/2420-6-0x00000000071F0000-0x0000000007230000-memory.dmp

Filesize
256KB

Download
memory/2420-7-0x00000000071F0000-0x0000000007230000-memory.dmp

Filesize
256KB

Download
memory/2420-8-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2420-9-0x0000000074290000-0x000000007497E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-10-0x00000000071F0000-0x0000000007230000-memory.dmp

Filesize
256KB

Download
memory/2420-12-0x0000000002E60000-0x0000000002F60000-memory.dmp

Filesize
1024KB

Download
memory/2420-13-0x0000000000230000-0x000000000025F000-memory.dmp

Filesize
188KB

Download
memory/2420-16-0x00000000071F0000-0x0000000007230000-memory.dmp

Filesize
256KB

Download
memory/2420-15-0x00000000071F0000-0x0000000007230000-memory.dmp

Filesize
256KB

Download
memory/2420-17-0x0000000074290000-0x000000007497E000-memory.dmp

Filesize
6.9MB

Download