redline | d81fa7107a59c18f2cee98c1eba8dee5752f05700efb152f49eacca745eae3e9

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6b790ba618946c08bd3ce158523f35.exe
Size

431KB
MD5

6a6b790ba618946c08bd3ce158523f35
SHA1

f97af346f035bc4345e9114a1a1dc5c44c207004
SHA256

d81fa7107a59c18f2cee98c1eba8dee5752f05700efb152f49eacca745eae3e9
SHA512

e2942e53b9f98468d7b7a4359ef94362b256f593664d81033334641affbe06bb58f02c925643fbf0cf6ba2b151b9b6d7402e440228cb04b3f342c8f91428d1ba
SSDEEP

6144:9gCJ35tjPxbTlV+Ro6NFkPx+I9r1rCM91e5ZmdQXZpPokW9PHxV8zjzV:55tDViRo6Nwx79r8YQXZpPo79PHCHV

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1004-3-0x0000000005120000-0x0000000005140000-memory.dmp	family_redline
behavioral2/memory/1004-5-0x00000000079F0000-0x0000000007A0E000-memory.dmp	family_redline
behavioral2/memory/1004-7-0x0000000007AE0000-0x0000000007AF0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1004-3-0x0000000005120000-0x0000000005140000-memory.dmp	family_sectoprat
behavioral2/memory/1004-5-0x00000000079F0000-0x0000000007A0E000-memory.dmp	family_sectoprat
behavioral2/memory/1004-21-0x0000000007AE0000-0x0000000007AF0000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6a6b790ba618946c08bd3ce158523f35.exe

description pid process

Token: SeDebugPrivilege 1004 6a6b790ba618946c08bd3ce158523f35.exe

description	pid	process
Token: SeDebugPrivilege	1004	6a6b790ba618946c08bd3ce158523f35.exe

C:\Users\Admin\AppData\Local\Temp\6a6b790ba618946c08bd3ce158523f35.exe
"C:\Users\Admin\AppData\Local\Temp\6a6b790ba618946c08bd3ce158523f35.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-1-0x0000000003320000-0x0000000003420000-memory.dmp

Filesize
1024KB

Download
memory/1004-2-0x00000000034F0000-0x000000000351F000-memory.dmp

Filesize
188KB

Download
memory/1004-3-0x0000000005120000-0x0000000005140000-memory.dmp

Filesize
128KB

Download
memory/1004-4-0x0000000007AF0000-0x0000000008094000-memory.dmp

Filesize
5.6MB

Download
memory/1004-6-0x0000000000400000-0x0000000003309000-memory.dmp

Filesize
47.0MB

Download
memory/1004-5-0x00000000079F0000-0x0000000007A0E000-memory.dmp

Filesize
120KB

Download
memory/1004-8-0x00000000080A0000-0x00000000086B8000-memory.dmp

Filesize
6.1MB

Download
memory/1004-7-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-10-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-9-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-11-0x0000000007AA0000-0x0000000007AB2000-memory.dmp

Filesize
72KB

Download
memory/1004-12-0x00000000086C0000-0x00000000086FC000-memory.dmp

Filesize
240KB

Download
memory/1004-13-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/1004-14-0x0000000008700000-0x000000000874C000-memory.dmp

Filesize
304KB

Download
memory/1004-15-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-16-0x0000000008890000-0x000000000899A000-memory.dmp

Filesize
1.0MB

Download
memory/1004-17-0x0000000000400000-0x0000000003309000-memory.dmp

Filesize
47.0MB

Download
memory/1004-18-0x0000000003320000-0x0000000003420000-memory.dmp

Filesize
1024KB

Download
memory/1004-20-0x00000000034F0000-0x000000000351F000-memory.dmp

Filesize
188KB

Download
memory/1004-21-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-22-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-23-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download
memory/1004-24-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/1004-25-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Filesize
64KB

Download