redline | 3d243c5f576ffa3f0f3e405764686809b9be85e791b946d2f1f3bc117fd17d26

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 12:12

Target

7d183dcb376ad8afea5c7fc6afe23028.exe
Size

288KB
MD5

7d183dcb376ad8afea5c7fc6afe23028
SHA1

7b0db13dae031242659924cacfb76c21bc4db802
SHA256

3d243c5f576ffa3f0f3e405764686809b9be85e791b946d2f1f3bc117fd17d26
SHA512

649cba39de56e2cdb4c34838a21f180ab2fe5c11cbb3a924b067eccbe31d55b15519ac6812c5106aee3696bb2cdbc3b853f4c783fd9841ad68dd8d611b4b66c5
SSDEEP

3072:xAYh79895F5DKWu52hkK3+tCgdMQByvgjOgL4eoSvK8dqvvmWMBNyVRfQuKT0yBc:xP2oWuAaK3iCa/yYjbL4ICfOzlRX6Ge

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-3-0x0000000003060000-0x0000000003080000-memory.dmp	family_redline
behavioral1/memory/1516-5-0x0000000007270000-0x00000000072B0000-memory.dmp	family_redline
behavioral1/memory/1516-7-0x0000000004670000-0x000000000468E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-3-0x0000000003060000-0x0000000003080000-memory.dmp	family_sectoprat
behavioral1/memory/1516-5-0x0000000007270000-0x00000000072B0000-memory.dmp	family_sectoprat
behavioral1/memory/1516-7-0x0000000004670000-0x000000000468E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7d183dcb376ad8afea5c7fc6afe23028.exe

description pid process

Token: SeDebugPrivilege 1516 7d183dcb376ad8afea5c7fc6afe23028.exe

description	pid	process
Token: SeDebugPrivilege	1516	7d183dcb376ad8afea5c7fc6afe23028.exe

C:\Users\Admin\AppData\Local\Temp\7d183dcb376ad8afea5c7fc6afe23028.exe
"C:\Users\Admin\AppData\Local\Temp\7d183dcb376ad8afea5c7fc6afe23028.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

memory/1516-1-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

Filesize
1024KB

Download
memory/1516-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1516-3-0x0000000003060000-0x0000000003080000-memory.dmp

Filesize
128KB

Download
memory/1516-4-0x0000000000400000-0x0000000002CD6000-memory.dmp

Filesize
40.8MB

Download
memory/1516-5-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download
memory/1516-6-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download
memory/1516-7-0x0000000004670000-0x000000000468E000-memory.dmp

Filesize
120KB

Download
memory/1516-8-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/1516-9-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download
memory/1516-12-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

Filesize
1024KB

Download
memory/1516-13-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download
memory/1516-14-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download
memory/1516-15-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download
memory/1516-16-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/1516-17-0x0000000007270000-0x00000000072B0000-memory.dmp

Filesize
256KB

Download