redline | 644282bccbb5b19329ac1f3377c3b39bdd99a89a4caee8325362d2e95e2ab738

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 09:49

Target

7ccf9d9abb5b38cbbd6f4fe172c3a2a5.exe
Size

276KB
MD5

7ccf9d9abb5b38cbbd6f4fe172c3a2a5
SHA1

09117a02c433e1fe186d9543de0499949207ee3d
SHA256

644282bccbb5b19329ac1f3377c3b39bdd99a89a4caee8325362d2e95e2ab738
SHA512

cced74f3ceea7d5d4632ade94efda8d98b2069fbcb0b02b725a5d96f14ce9121043a12beab33bb92598680ada5f6a7b92e4f2de555da670167d443db8e8383a6
SSDEEP

6144:QnKqFeF2s42qK8wUpzbfblONVLqYzEYdLzRwoOL:4tls42qcUpnzlOHuYzT1woO

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2124-3-0x0000000002CC0000-0x0000000002CE0000-memory.dmp	family_redline
behavioral1/memory/2124-6-0x00000000047C0000-0x00000000047DE000-memory.dmp	family_redline
behavioral1/memory/2124-5-0x00000000047F0000-0x0000000004830000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2124-3-0x0000000002CC0000-0x0000000002CE0000-memory.dmp	family_sectoprat
behavioral1/memory/2124-6-0x00000000047C0000-0x00000000047DE000-memory.dmp	family_sectoprat
behavioral1/memory/2124-5-0x00000000047F0000-0x0000000004830000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7ccf9d9abb5b38cbbd6f4fe172c3a2a5.exe

description pid process

Token: SeDebugPrivilege 2124 7ccf9d9abb5b38cbbd6f4fe172c3a2a5.exe

description	pid	process
Token: SeDebugPrivilege	2124	7ccf9d9abb5b38cbbd6f4fe172c3a2a5.exe

C:\Users\Admin\AppData\Local\Temp\7ccf9d9abb5b38cbbd6f4fe172c3a2a5.exe
"C:\Users\Admin\AppData\Local\Temp\7ccf9d9abb5b38cbbd6f4fe172c3a2a5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124

memory/2124-2-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/2124-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

Filesize
1024KB

Download
memory/2124-3-0x0000000002CC0000-0x0000000002CE0000-memory.dmp

Filesize
128KB

Download
memory/2124-4-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/2124-6-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2124-5-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2124-7-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2124-8-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-9-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2124-10-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/2124-11-0x0000000002CF0000-0x0000000002DF0000-memory.dmp

Filesize
1024KB

Download
memory/2124-13-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2124-14-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download