redline | 119da9707f6d59fdb7649c719d2e3ec2f69deed19f4c3713da3ce2ddbf31adb8

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8868ede96bbc1cfdf4c2c049182ab1ec.exe
Size

386KB
MD5

8868ede96bbc1cfdf4c2c049182ab1ec
SHA1

3b19594b64ab234f51025b04093ba54fd6203fd9
SHA256

119da9707f6d59fdb7649c719d2e3ec2f69deed19f4c3713da3ce2ddbf31adb8
SHA512

18ef778566238d27ddb98b0d748143674911c61d22bdab6862ea423f67d5b952025d1a11cd3471b966b492c48390bffc2d6d665eacf14341760e5739b43d7f49
SSDEEP

6144:NhdmyaeDCQK4iSsybfn80MjwvBTGMSmNE1tHN54SUijcEQ9H+x2xoLCjxvc:o5eDV3ibyL8NM5pIHgti1Q9e4GL8c

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2976-7-0x0000000002670000-0x0000000002690000-memory.dmp	family_redline
behavioral2/memory/2976-10-0x0000000002800000-0x000000000281E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2976-7-0x0000000002670000-0x0000000002690000-memory.dmp	family_sectoprat
behavioral2/memory/2976-10-0x0000000002800000-0x000000000281E000-memory.dmp	family_sectoprat
behavioral2/memory/2976-23-0x0000000004CC0000-0x0000000004CD0000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8868ede96bbc1cfdf4c2c049182ab1ec.exe

description pid process

Token: SeDebugPrivilege 2976 8868ede96bbc1cfdf4c2c049182ab1ec.exe

description	pid	process
Token: SeDebugPrivilege	2976	8868ede96bbc1cfdf4c2c049182ab1ec.exe

C:\Users\Admin\AppData\Local\Temp\8868ede96bbc1cfdf4c2c049182ab1ec.exe
"C:\Users\Admin\AppData\Local\Temp\8868ede96bbc1cfdf4c2c049182ab1ec.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/2976-2-0x00000000021D0000-0x00000000021FF000-memory.dmp

Filesize
188KB

Download
memory/2976-3-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2976-4-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/2976-5-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2976-6-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2976-7-0x0000000002670000-0x0000000002690000-memory.dmp

Filesize
128KB

Download
memory/2976-8-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2976-9-0x0000000004CD0000-0x0000000005274000-memory.dmp

Filesize
5.6MB

Download
memory/2976-10-0x0000000002800000-0x000000000281E000-memory.dmp

Filesize
120KB

Download
memory/2976-11-0x0000000005280000-0x0000000005898000-memory.dmp

Filesize
6.1MB

Download
memory/2976-12-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/2976-13-0x0000000004C30000-0x0000000004C6C000-memory.dmp

Filesize
240KB

Download
memory/2976-14-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2976-15-0x00000000058A0000-0x00000000058EC000-memory.dmp

Filesize
304KB

Download
memory/2976-16-0x0000000005A00000-0x0000000005B0A000-memory.dmp

Filesize
1.0MB

Download
memory/2976-17-0x00000000005B0000-0x00000000006B0000-memory.dmp

Filesize
1024KB

Download
memory/2976-19-0x00000000021D0000-0x00000000021FF000-memory.dmp

Filesize
188KB

Download
memory/2976-20-0x0000000074EC0000-0x0000000075670000-memory.dmp

Filesize
7.7MB

Download
memory/2976-21-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2976-23-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download
memory/2976-24-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Filesize
64KB

Download