redline | 772fccb900bcd908c3c72da3d17ddc26b7bde8f8accc7bea47de8c734f0988d6

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b6e02624205df3a73f5862b2a8e6163.exe
Size

310KB
MD5

6b6e02624205df3a73f5862b2a8e6163
SHA1

117d122b8d6de82b32da9c92bf830b124b0456cd
SHA256

772fccb900bcd908c3c72da3d17ddc26b7bde8f8accc7bea47de8c734f0988d6
SHA512

362fd9647e76c9cf9a9e83ad6ad181888f086178000a7b1dfd19a1768c4f012a3150b090012fff1110646cb6e4828662fb5d09539c320a9c0da0f031a81ba93b
SSDEEP

6144:pepph46Tmyg6vi5f67TRT19zprxKTAnRwoOLjx9:pehjngd5fWTRJ91rIARwoOvx9

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4572-6-0x0000000004D50000-0x0000000004D70000-memory.dmp	family_redline
behavioral2/memory/4572-11-0x0000000004F30000-0x0000000004F4E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4572-6-0x0000000004D50000-0x0000000004D70000-memory.dmp	family_sectoprat
behavioral2/memory/4572-11-0x0000000004F30000-0x0000000004F4E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6b6e02624205df3a73f5862b2a8e6163.exe

description pid process

Token: SeDebugPrivilege 4572 6b6e02624205df3a73f5862b2a8e6163.exe

description	pid	process
Token: SeDebugPrivilege	4572	6b6e02624205df3a73f5862b2a8e6163.exe

C:\Users\Admin\AppData\Local\Temp\6b6e02624205df3a73f5862b2a8e6163.exe
"C:\Users\Admin\AppData\Local\Temp\6b6e02624205df3a73f5862b2a8e6163.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-1-0x0000000002E00000-0x0000000002F00000-memory.dmp

Filesize
1024KB

Download
memory/4572-2-0x00000000049E0000-0x0000000004A0F000-memory.dmp

Filesize
188KB

Download
memory/4572-3-0x0000000000400000-0x0000000002C84000-memory.dmp

Filesize
40.5MB

Download
memory/4572-4-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4572-5-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-6-0x0000000004D50000-0x0000000004D70000-memory.dmp

Filesize
128KB

Download
memory/4572-7-0x0000000000400000-0x0000000002C84000-memory.dmp

Filesize
40.5MB

Download
memory/4572-8-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-9-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-10-0x00000000073B0000-0x0000000007954000-memory.dmp

Filesize
5.6MB

Download
memory/4572-11-0x0000000004F30000-0x0000000004F4E000-memory.dmp

Filesize
120KB

Download
memory/4572-12-0x0000000007960000-0x0000000007F78000-memory.dmp

Filesize
6.1MB

Download
memory/4572-13-0x0000000008000000-0x0000000008012000-memory.dmp

Filesize
72KB

Download
memory/4572-14-0x0000000008020000-0x000000000805C000-memory.dmp

Filesize
240KB

Download
memory/4572-15-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-16-0x0000000008080000-0x00000000080CC000-memory.dmp

Filesize
304KB

Download
memory/4572-17-0x0000000008210000-0x000000000831A000-memory.dmp

Filesize
1.0MB

Download
memory/4572-18-0x0000000002E00000-0x0000000002F00000-memory.dmp

Filesize
1024KB

Download
memory/4572-20-0x00000000049E0000-0x0000000004A0F000-memory.dmp

Filesize
188KB

Download
memory/4572-21-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4572-23-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-24-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-25-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4572-26-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download