redline | 119da9707f6d59fdb7649c719d2e3ec2f69deed19f4c3713da3ce2ddbf31adb8

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 03:15

Target

8868ede96bbc1cfdf4c2c049182ab1ec.exe
Size

386KB
MD5

8868ede96bbc1cfdf4c2c049182ab1ec
SHA1

3b19594b64ab234f51025b04093ba54fd6203fd9
SHA256

119da9707f6d59fdb7649c719d2e3ec2f69deed19f4c3713da3ce2ddbf31adb8
SHA512

18ef778566238d27ddb98b0d748143674911c61d22bdab6862ea423f67d5b952025d1a11cd3471b966b492c48390bffc2d6d665eacf14341760e5739b43d7f49
SSDEEP

6144:NhdmyaeDCQK4iSsybfn80MjwvBTGMSmNE1tHN54SUijcEQ9H+x2xoLCjxvc:o5eDV3ibyL8NM5pIHgti1Q9e4GL8c

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-4-0x00000000005E0000-0x0000000000600000-memory.dmp	family_redline
behavioral1/memory/2220-8-0x0000000002260000-0x000000000227E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-4-0x00000000005E0000-0x0000000000600000-memory.dmp	family_sectoprat
behavioral1/memory/2220-8-0x0000000002260000-0x000000000227E000-memory.dmp	family_sectoprat
behavioral1/memory/2220-9-0x00000000049B0000-0x00000000049F0000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8868ede96bbc1cfdf4c2c049182ab1ec.exe

description pid process

Token: SeDebugPrivilege 2220 8868ede96bbc1cfdf4c2c049182ab1ec.exe

description	pid	process
Token: SeDebugPrivilege	2220	8868ede96bbc1cfdf4c2c049182ab1ec.exe

C:\Users\Admin\AppData\Local\Temp\8868ede96bbc1cfdf4c2c049182ab1ec.exe
"C:\Users\Admin\AppData\Local\Temp\8868ede96bbc1cfdf4c2c049182ab1ec.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220

memory/2220-1-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2220-2-0x0000000000480000-0x00000000004AF000-memory.dmp

Filesize
188KB

Download
memory/2220-3-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2220-5-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-4-0x00000000005E0000-0x0000000000600000-memory.dmp

Filesize
128KB

Download
memory/2220-6-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download
memory/2220-7-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download
memory/2220-8-0x0000000002260000-0x000000000227E000-memory.dmp

Filesize
120KB

Download
memory/2220-9-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download
memory/2220-11-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2220-12-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-14-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download