redline | f0c3961aa5abda23c7a481bca4a69cf749de693e818bfed4b06af0d9dca0fc0b

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-01-2024 20:49

Target

6391e978654d766cca43cb55add98326.exe
Size

350KB
MD5

6391e978654d766cca43cb55add98326
SHA1

4bcf186d3326471811328f48082f6d7c24d5b292
SHA256

f0c3961aa5abda23c7a481bca4a69cf749de693e818bfed4b06af0d9dca0fc0b
SHA512

c22b66fd3e2fcb8596557299c4f6d1538347878bc5737ffda7e21a86bce1a7c54395a6687578d76ea3222273508419270b519cc468bd72f57b95924fb096aa4f
SSDEEP

6144:8bZuorEoo1a03TcTRPemdWYszdLZXLKTDVAZrNVfs8V:84Boo1dQsdLNN2

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-3-0x0000000002D10000-0x0000000002D30000-memory.dmp	family_redline
behavioral1/memory/1720-4-0x0000000004AD0000-0x0000000004AEE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-3-0x0000000002D10000-0x0000000002D30000-memory.dmp	family_sectoprat
behavioral1/memory/1720-4-0x0000000004AD0000-0x0000000004AEE000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6391e978654d766cca43cb55add98326.exe

description pid process

Token: SeDebugPrivilege 1720 6391e978654d766cca43cb55add98326.exe

description	pid	process
Token: SeDebugPrivilege	1720	6391e978654d766cca43cb55add98326.exe

C:\Users\Admin\AppData\Local\Temp\6391e978654d766cca43cb55add98326.exe
"C:\Users\Admin\AppData\Local\Temp\6391e978654d766cca43cb55add98326.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

memory/1720-1-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/1720-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1720-3-0x0000000002D10000-0x0000000002D30000-memory.dmp

Filesize
128KB

Download
memory/1720-4-0x0000000004AD0000-0x0000000004AEE000-memory.dmp

Filesize
120KB

Download
memory/1720-5-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/1720-8-0x0000000007020000-0x0000000007060000-memory.dmp

Filesize
256KB

Download
memory/1720-7-0x0000000007020000-0x0000000007060000-memory.dmp

Filesize
256KB

Download
memory/1720-6-0x0000000007020000-0x0000000007060000-memory.dmp

Filesize
256KB

Download
memory/1720-9-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/1720-12-0x0000000007020000-0x0000000007060000-memory.dmp

Filesize
256KB

Download
memory/1720-11-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/1720-14-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download