redline | f0c3961aa5abda23c7a481bca4a69cf749de693e818bfed4b06af0d9dca0fc0b

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2024 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6391e978654d766cca43cb55add98326.exe
Size

350KB
MD5

6391e978654d766cca43cb55add98326
SHA1

4bcf186d3326471811328f48082f6d7c24d5b292
SHA256

f0c3961aa5abda23c7a481bca4a69cf749de693e818bfed4b06af0d9dca0fc0b
SHA512

c22b66fd3e2fcb8596557299c4f6d1538347878bc5737ffda7e21a86bce1a7c54395a6687578d76ea3222273508419270b519cc468bd72f57b95924fb096aa4f
SSDEEP

6144:8bZuorEoo1a03TcTRPemdWYszdLZXLKTDVAZrNVfs8V:84Boo1dQsdLNN2

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3524-3-0x0000000004A40000-0x0000000004A60000-memory.dmp	family_redline
behavioral2/memory/3524-9-0x0000000004D30000-0x0000000004D4E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3524-3-0x0000000004A40000-0x0000000004A60000-memory.dmp	family_sectoprat
behavioral2/memory/3524-5-0x00000000072E0000-0x00000000072F0000-memory.dmp	family_sectoprat
behavioral2/memory/3524-9-0x0000000004D30000-0x0000000004D4E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6391e978654d766cca43cb55add98326.exe

description pid process

Token: SeDebugPrivilege 3524 6391e978654d766cca43cb55add98326.exe

description	pid	process
Token: SeDebugPrivilege	3524	6391e978654d766cca43cb55add98326.exe

C:\Users\Admin\AppData\Local\Temp\6391e978654d766cca43cb55add98326.exe
"C:\Users\Admin\AppData\Local\Temp\6391e978654d766cca43cb55add98326.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-1-0x0000000002D20000-0x0000000002E20000-memory.dmp

Filesize
1024KB

Download
memory/3524-2-0x0000000004890000-0x00000000048BF000-memory.dmp

Filesize
188KB

Download
memory/3524-3-0x0000000004A40000-0x0000000004A60000-memory.dmp

Filesize
128KB

Download
memory/3524-4-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/3524-5-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3524-7-0x00000000072F0000-0x0000000007894000-memory.dmp

Filesize
5.6MB

Download
memory/3524-6-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3524-9-0x0000000004D30000-0x0000000004D4E000-memory.dmp

Filesize
120KB

Download
memory/3524-8-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3524-11-0x00000000078A0000-0x0000000007EB8000-memory.dmp

Filesize
6.1MB

Download
memory/3524-10-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/3524-12-0x0000000007EC0000-0x0000000007ED2000-memory.dmp

Filesize
72KB

Download
memory/3524-13-0x0000000007EE0000-0x0000000007F1C000-memory.dmp

Filesize
240KB

Download
memory/3524-14-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3524-15-0x0000000007F40000-0x0000000007F8C000-memory.dmp

Filesize
304KB

Download
memory/3524-16-0x00000000080D0000-0x00000000081DA000-memory.dmp

Filesize
1.0MB

Download
memory/3524-17-0x0000000000400000-0x0000000002C8E000-memory.dmp

Filesize
40.6MB

Download
memory/3524-18-0x0000000004890000-0x00000000048BF000-memory.dmp

Filesize
188KB

Download
memory/3524-20-0x0000000002D20000-0x0000000002E20000-memory.dmp

Filesize
1024KB

Download
memory/3524-21-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3524-22-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download
memory/3524-23-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/3524-24-0x00000000072E0000-0x00000000072F0000-memory.dmp

Filesize
64KB

Download