redline | 3d243c5f576ffa3f0f3e405764686809b9be85e791b946d2f1f3bc117fd17d26

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d183dcb376ad8afea5c7fc6afe23028.exe
Size

288KB
MD5

7d183dcb376ad8afea5c7fc6afe23028
SHA1

7b0db13dae031242659924cacfb76c21bc4db802
SHA256

3d243c5f576ffa3f0f3e405764686809b9be85e791b946d2f1f3bc117fd17d26
SHA512

649cba39de56e2cdb4c34838a21f180ab2fe5c11cbb3a924b067eccbe31d55b15519ac6812c5106aee3696bb2cdbc3b853f4c783fd9841ad68dd8d611b4b66c5
SSDEEP

3072:xAYh79895F5DKWu52hkK3+tCgdMQByvgjOgL4eoSvK8dqvvmWMBNyVRfQuKT0yBc:xP2oWuAaK3iCa/yYjbL4ICfOzlRX6Ge

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5084-3-0x0000000004ED0000-0x0000000004EF0000-memory.dmp	family_redline
behavioral2/memory/5084-9-0x0000000004F20000-0x0000000004F3E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5084-3-0x0000000004ED0000-0x0000000004EF0000-memory.dmp	family_sectoprat
behavioral2/memory/5084-5-0x0000000004F10000-0x0000000004F20000-memory.dmp	family_sectoprat
behavioral2/memory/5084-9-0x0000000004F20000-0x0000000004F3E000-memory.dmp	family_sectoprat
behavioral2/memory/5084-20-0x0000000004F10000-0x0000000004F20000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7d183dcb376ad8afea5c7fc6afe23028.exe

description pid process

Token: SeDebugPrivilege 5084 7d183dcb376ad8afea5c7fc6afe23028.exe

description	pid	process
Token: SeDebugPrivilege	5084	7d183dcb376ad8afea5c7fc6afe23028.exe

C:\Users\Admin\AppData\Local\Temp\7d183dcb376ad8afea5c7fc6afe23028.exe
"C:\Users\Admin\AppData\Local\Temp\7d183dcb376ad8afea5c7fc6afe23028.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5084-1-0x0000000002F60000-0x0000000003060000-memory.dmp

Filesize
1024KB

Download
memory/5084-2-0x0000000002EA0000-0x0000000002ECF000-memory.dmp

Filesize
188KB

Download
memory/5084-3-0x0000000004ED0000-0x0000000004EF0000-memory.dmp

Filesize
128KB

Download
memory/5084-4-0x0000000000400000-0x0000000002CD6000-memory.dmp

Filesize
40.8MB

Download
memory/5084-5-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5084-6-0x00000000074E0000-0x0000000007A84000-memory.dmp

Filesize
5.6MB

Download
memory/5084-7-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/5084-8-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5084-9-0x0000000004F20000-0x0000000004F3E000-memory.dmp

Filesize
120KB

Download
memory/5084-10-0x0000000007A90000-0x00000000080A8000-memory.dmp

Filesize
6.1MB

Download
memory/5084-11-0x0000000005130000-0x0000000005142000-memory.dmp

Filesize
72KB

Download
memory/5084-12-0x0000000005150000-0x000000000518C000-memory.dmp

Filesize
240KB

Download
memory/5084-13-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5084-14-0x00000000080D0000-0x000000000811C000-memory.dmp

Filesize
304KB

Download
memory/5084-15-0x0000000008260000-0x000000000836A000-memory.dmp

Filesize
1.0MB

Download
memory/5084-16-0x0000000000400000-0x0000000002CD6000-memory.dmp

Filesize
40.8MB

Download
memory/5084-17-0x0000000002F60000-0x0000000003060000-memory.dmp

Filesize
1024KB

Download
memory/5084-19-0x0000000002EA0000-0x0000000002ECF000-memory.dmp

Filesize
188KB

Download
memory/5084-20-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5084-21-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/5084-22-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/5084-24-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download