redline | f845715e4a08aa193c75aadbd565c88d104a2977c5b3c771a1dacbb89c34de92

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2024 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83cead1178a7f1e9896069ccdf24e8de.exe
Size

308KB
MD5

83cead1178a7f1e9896069ccdf24e8de
SHA1

1b1805418cecd3addc8b349bddc599a509d4dca1
SHA256

f845715e4a08aa193c75aadbd565c88d104a2977c5b3c771a1dacbb89c34de92
SHA512

4c0974dfd23b5485aa970e726ff97838603a8c9238055f57c3ec368a25fcc7e465e86f165c4cae2b837c41b306ffaa9d769bafabac12b5b951f10a856e34494b
SSDEEP

6144:soL8hYlng/UUrj5YJan8fAnRwoOLNTDW:f8hYlgcUpYYn4ARwoO

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3724-3-0x0000000004C80000-0x0000000004CA0000-memory.dmp	family_redline
behavioral2/memory/3724-7-0x0000000004F20000-0x0000000004F3E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3724-3-0x0000000004C80000-0x0000000004CA0000-memory.dmp	family_sectoprat
behavioral2/memory/3724-7-0x0000000004F20000-0x0000000004F3E000-memory.dmp	family_sectoprat
behavioral2/memory/3724-21-0x0000000007520000-0x0000000007530000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

83cead1178a7f1e9896069ccdf24e8de.exe

description pid process

Token: SeDebugPrivilege 3724 83cead1178a7f1e9896069ccdf24e8de.exe

description	pid	process
Token: SeDebugPrivilege	3724	83cead1178a7f1e9896069ccdf24e8de.exe

C:\Users\Admin\AppData\Local\Temp\83cead1178a7f1e9896069ccdf24e8de.exe
"C:\Users\Admin\AppData\Local\Temp\83cead1178a7f1e9896069ccdf24e8de.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3724-1-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download
memory/3724-2-0x00000000049D0000-0x00000000049FF000-memory.dmp

Filesize
188KB

Download
memory/3724-3-0x0000000004C80000-0x0000000004CA0000-memory.dmp

Filesize
128KB

Download
memory/3724-4-0x0000000007530000-0x0000000007AD4000-memory.dmp

Filesize
5.6MB

Download
memory/3724-8-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download
memory/3724-5-0x0000000000400000-0x0000000002C83000-memory.dmp

Filesize
40.5MB

Download
memory/3724-9-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download
memory/3724-7-0x0000000004F20000-0x0000000004F3E000-memory.dmp

Filesize
120KB

Download
memory/3724-6-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download
memory/3724-13-0x0000000007440000-0x000000000747C000-memory.dmp

Filesize
240KB

Download
memory/3724-12-0x0000000007420000-0x0000000007432000-memory.dmp

Filesize
72KB

Download
memory/3724-11-0x0000000007AE0000-0x00000000080F8000-memory.dmp

Filesize
6.1MB

Download
memory/3724-10-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/3724-15-0x00000000074A0000-0x00000000074EC000-memory.dmp

Filesize
304KB

Download
memory/3724-14-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download
memory/3724-16-0x0000000008210000-0x000000000831A000-memory.dmp

Filesize
1.0MB

Download
memory/3724-18-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Filesize
1024KB

Download
memory/3724-19-0x00000000049D0000-0x00000000049FF000-memory.dmp

Filesize
188KB

Download
memory/3724-21-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download
memory/3724-22-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/3724-23-0x0000000007520000-0x0000000007530000-memory.dmp

Filesize
64KB

Download