redline | d81fa7107a59c18f2cee98c1eba8dee5752f05700efb152f49eacca745eae3e9

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-01-2024 12:25

Target

6a6b790ba618946c08bd3ce158523f35.exe
Size

431KB
MD5

6a6b790ba618946c08bd3ce158523f35
SHA1

f97af346f035bc4345e9114a1a1dc5c44c207004
SHA256

d81fa7107a59c18f2cee98c1eba8dee5752f05700efb152f49eacca745eae3e9
SHA512

e2942e53b9f98468d7b7a4359ef94362b256f593664d81033334641affbe06bb58f02c925643fbf0cf6ba2b151b9b6d7402e440228cb04b3f342c8f91428d1ba
SSDEEP

6144:9gCJ35tjPxbTlV+Ro6NFkPx+I9r1rCM91e5ZmdQXZpPokW9PHxV8zjzV:55tDViRo6Nwx79r8YQXZpPo79PHCHV

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/832-3-0x0000000004E20000-0x0000000004E40000-memory.dmp	family_redline
behavioral1/memory/832-7-0x0000000005030000-0x000000000504E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/832-3-0x0000000004E20000-0x0000000004E40000-memory.dmp	family_sectoprat
behavioral1/memory/832-7-0x0000000005030000-0x000000000504E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6a6b790ba618946c08bd3ce158523f35.exe

description pid process

Token: SeDebugPrivilege 832 6a6b790ba618946c08bd3ce158523f35.exe

description	pid	process
Token: SeDebugPrivilege	832	6a6b790ba618946c08bd3ce158523f35.exe

C:\Users\Admin\AppData\Local\Temp\6a6b790ba618946c08bd3ce158523f35.exe
"C:\Users\Admin\AppData\Local\Temp\6a6b790ba618946c08bd3ce158523f35.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:832

memory/832-1-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/832-2-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/832-3-0x0000000004E20000-0x0000000004E40000-memory.dmp

Filesize
128KB

Download
memory/832-4-0x0000000000400000-0x0000000003309000-memory.dmp

Filesize
47.0MB

Download
memory/832-5-0x00000000075C0000-0x0000000007600000-memory.dmp

Filesize
256KB

Download
memory/832-6-0x00000000075C0000-0x0000000007600000-memory.dmp

Filesize
256KB

Download
memory/832-8-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/832-7-0x0000000005030000-0x000000000504E000-memory.dmp

Filesize
120KB

Download
memory/832-9-0x00000000075C0000-0x0000000007600000-memory.dmp

Filesize
256KB

Download
memory/832-11-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/832-12-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/832-13-0x00000000075C0000-0x0000000007600000-memory.dmp

Filesize
256KB

Download
memory/832-14-0x00000000075C0000-0x0000000007600000-memory.dmp

Filesize
256KB

Download
memory/832-15-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download