redline | a8aa6deb2d60d51d0474c80623aba4fa0eaae6c160364a2021cfa52d41f5bc09

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78b9e3ed0f88643a927d7a44451c1c3c.exe
Size

273KB
MD5

78b9e3ed0f88643a927d7a44451c1c3c
SHA1

7b48a0115bd5ff656fbb02d6356d07f13c296e56
SHA256

a8aa6deb2d60d51d0474c80623aba4fa0eaae6c160364a2021cfa52d41f5bc09
SHA512

cb7af9f7a725b31d93521f05e8a2ba82198d4da0aeb42216bcc4fe277259f9dd84730d81102559a0bea0ef63c357690c77d65589d537668fd27f87f5cbb4c1e4
SSDEEP

6144:NTX9rKrLC2lJ5QwRPjLkFQGJ78At/Zp7I1Vhv:JIrzJGwNABZp0

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/224-5-0x0000000004B70000-0x0000000004B90000-memory.dmp	family_redline
behavioral2/memory/224-9-0x0000000004D80000-0x0000000004D9E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/224-5-0x0000000004B70000-0x0000000004B90000-memory.dmp	family_sectoprat
behavioral2/memory/224-7-0x0000000007490000-0x00000000074A0000-memory.dmp	family_sectoprat
behavioral2/memory/224-9-0x0000000004D80000-0x0000000004D9E000-memory.dmp	family_sectoprat
behavioral2/memory/224-22-0x0000000007490000-0x00000000074A0000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

78b9e3ed0f88643a927d7a44451c1c3c.exe

description pid process

Token: SeDebugPrivilege 224 78b9e3ed0f88643a927d7a44451c1c3c.exe

description	pid	process
Token: SeDebugPrivilege	224	78b9e3ed0f88643a927d7a44451c1c3c.exe

C:\Users\Admin\AppData\Local\Temp\78b9e3ed0f88643a927d7a44451c1c3c.exe
"C:\Users\Admin\AppData\Local\Temp\78b9e3ed0f88643a927d7a44451c1c3c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-1-0x0000000002E70000-0x0000000002F70000-memory.dmp

Filesize
1024KB

Download
memory/224-2-0x0000000002E00000-0x0000000002E2F000-memory.dmp

Filesize
188KB

Download
memory/224-3-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/224-4-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/224-5-0x0000000004B70000-0x0000000004B90000-memory.dmp

Filesize
128KB

Download
memory/224-6-0x0000000007490000-0x00000000074A0000-memory.dmp

Filesize
64KB

Download
memory/224-7-0x0000000007490000-0x00000000074A0000-memory.dmp

Filesize
64KB

Download
memory/224-8-0x00000000074A0000-0x0000000007A44000-memory.dmp

Filesize
5.6MB

Download
memory/224-9-0x0000000004D80000-0x0000000004D9E000-memory.dmp

Filesize
120KB

Download
memory/224-10-0x0000000007A50000-0x0000000008068000-memory.dmp

Filesize
6.1MB

Download
memory/224-11-0x0000000007410000-0x0000000007422000-memory.dmp

Filesize
72KB

Download
memory/224-12-0x0000000007430000-0x000000000746C000-memory.dmp

Filesize
240KB

Download
memory/224-14-0x0000000008070000-0x00000000080BC000-memory.dmp

Filesize
304KB

Download
memory/224-13-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/224-15-0x0000000007490000-0x00000000074A0000-memory.dmp

Filesize
64KB

Download
memory/224-16-0x0000000008200000-0x000000000830A000-memory.dmp

Filesize
1.0MB

Download
memory/224-18-0x0000000002E70000-0x0000000002F70000-memory.dmp

Filesize
1024KB

Download
memory/224-19-0x0000000002E00000-0x0000000002E2F000-memory.dmp

Filesize
188KB

Download
memory/224-21-0x0000000074960000-0x0000000075110000-memory.dmp

Filesize
7.7MB

Download
memory/224-22-0x0000000007490000-0x00000000074A0000-memory.dmp

Filesize
64KB

Download
memory/224-24-0x0000000007490000-0x00000000074A0000-memory.dmp

Filesize
64KB

Download