redline | f845715e4a08aa193c75aadbd565c88d104a2977c5b3c771a1dacbb89c34de92

Analysis

max time kernel
142s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-01-2024 07:21

Target

83cead1178a7f1e9896069ccdf24e8de.exe
Size

308KB
MD5

83cead1178a7f1e9896069ccdf24e8de
SHA1

1b1805418cecd3addc8b349bddc599a509d4dca1
SHA256

f845715e4a08aa193c75aadbd565c88d104a2977c5b3c771a1dacbb89c34de92
SHA512

4c0974dfd23b5485aa970e726ff97838603a8c9238055f57c3ec368a25fcc7e465e86f165c4cae2b837c41b306ffaa9d769bafabac12b5b951f10a856e34494b
SSDEEP

6144:soL8hYlng/UUrj5YJan8fAnRwoOLNTDW:f8hYlgcUpYYn4ARwoO

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-3-0x0000000002C90000-0x0000000002CB0000-memory.dmp	family_redline
behavioral1/memory/1656-5-0x0000000007120000-0x0000000007160000-memory.dmp	family_redline
behavioral1/memory/1656-9-0x0000000002DC0000-0x0000000002DDE000-memory.dmp	family_redline
behavioral1/memory/1656-17-0x0000000007120000-0x0000000007160000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1656-3-0x0000000002C90000-0x0000000002CB0000-memory.dmp	family_sectoprat
behavioral1/memory/1656-5-0x0000000007120000-0x0000000007160000-memory.dmp	family_sectoprat
behavioral1/memory/1656-9-0x0000000002DC0000-0x0000000002DDE000-memory.dmp	family_sectoprat
behavioral1/memory/1656-17-0x0000000007120000-0x0000000007160000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

83cead1178a7f1e9896069ccdf24e8de.exe

description pid process

Token: SeDebugPrivilege 1656 83cead1178a7f1e9896069ccdf24e8de.exe

description	pid	process
Token: SeDebugPrivilege	1656	83cead1178a7f1e9896069ccdf24e8de.exe

C:\Users\Admin\AppData\Local\Temp\83cead1178a7f1e9896069ccdf24e8de.exe
"C:\Users\Admin\AppData\Local\Temp\83cead1178a7f1e9896069ccdf24e8de.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

memory/1656-1-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

Filesize
1024KB

Download
memory/1656-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/1656-3-0x0000000002C90000-0x0000000002CB0000-memory.dmp

Filesize
128KB

Download
memory/1656-4-0x0000000000400000-0x0000000002C83000-memory.dmp

Filesize
40.5MB

Download
memory/1656-6-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download
memory/1656-5-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download
memory/1656-7-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-8-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download
memory/1656-9-0x0000000002DC0000-0x0000000002DDE000-memory.dmp

Filesize
120KB

Download
memory/1656-11-0x0000000002DE0000-0x0000000002EE0000-memory.dmp

Filesize
1024KB

Download
memory/1656-13-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download
memory/1656-14-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download
memory/1656-15-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-16-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download
memory/1656-17-0x0000000007120000-0x0000000007160000-memory.dmp

Filesize
256KB

Download