redline | 1a7b59228eb80c77fbbe268f906dd8452d24750c67cc216ae2b4aead840dd504

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f24fae4e330e0fc92d6c1e665538d43.exe
Size

322KB
MD5

8f24fae4e330e0fc92d6c1e665538d43
SHA1

f0904364d2195fa4e05cd51354315935bb1b0ac4
SHA256

1a7b59228eb80c77fbbe268f906dd8452d24750c67cc216ae2b4aead840dd504
SHA512

8b1ead96fc7f5651fa607f9d80d00527fac5e1f1fa618d4cff436e9e45c5d8299b8ca7d9004c03497e46e18778c6b67db938dbe43a9ba759a18ced0bd076aa4f
SSDEEP

6144:1hs4cHdHJMaV2MXMKz+PRyJbOb1d9WWCIwHoLA:Xs40OF+KZs8l9C5ILA

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5024-3-0x0000000004CE0000-0x0000000004D00000-memory.dmp	family_redline
behavioral2/memory/5024-6-0x0000000004E20000-0x0000000004E3E000-memory.dmp	family_redline
behavioral2/memory/5024-7-0x0000000007420000-0x0000000007430000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5024-3-0x0000000004CE0000-0x0000000004D00000-memory.dmp	family_sectoprat
behavioral2/memory/5024-6-0x0000000004E20000-0x0000000004E3E000-memory.dmp	family_sectoprat
behavioral2/memory/5024-21-0x0000000007420000-0x0000000007430000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8f24fae4e330e0fc92d6c1e665538d43.exe

description pid process

Token: SeDebugPrivilege 5024 8f24fae4e330e0fc92d6c1e665538d43.exe

description	pid	process
Token: SeDebugPrivilege	5024	8f24fae4e330e0fc92d6c1e665538d43.exe

C:\Users\Admin\AppData\Local\Temp\8f24fae4e330e0fc92d6c1e665538d43.exe
"C:\Users\Admin\AppData\Local\Temp\8f24fae4e330e0fc92d6c1e665538d43.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-1-0x0000000002F70000-0x0000000003070000-memory.dmp

Filesize
1024KB

Download
memory/5024-2-0x0000000002F30000-0x0000000002F5F000-memory.dmp

Filesize
188KB

Download
memory/5024-3-0x0000000004CE0000-0x0000000004D00000-memory.dmp

Filesize
128KB

Download
memory/5024-5-0x0000000000400000-0x0000000002C86000-memory.dmp

Filesize
40.5MB

Download
memory/5024-4-0x0000000007430000-0x00000000079D4000-memory.dmp

Filesize
5.6MB

Download
memory/5024-6-0x0000000004E20000-0x0000000004E3E000-memory.dmp

Filesize
120KB

Download
memory/5024-7-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/5024-9-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/5024-8-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/5024-10-0x00000000079E0000-0x0000000007FF8000-memory.dmp

Filesize
6.1MB

Download
memory/5024-11-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/5024-12-0x0000000008000000-0x0000000008012000-memory.dmp

Filesize
72KB

Download
memory/5024-13-0x0000000008020000-0x000000000805C000-memory.dmp

Filesize
240KB

Download
memory/5024-14-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/5024-15-0x0000000008080000-0x00000000080CC000-memory.dmp

Filesize
304KB

Download
memory/5024-16-0x0000000008210000-0x000000000831A000-memory.dmp

Filesize
1.0MB

Download
memory/5024-17-0x0000000000400000-0x0000000002C86000-memory.dmp

Filesize
40.5MB

Download
memory/5024-18-0x0000000002F30000-0x0000000002F5F000-memory.dmp

Filesize
188KB

Download
memory/5024-19-0x0000000002F70000-0x0000000003070000-memory.dmp

Filesize
1024KB

Download
memory/5024-21-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download
memory/5024-22-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/5024-23-0x0000000007420000-0x0000000007430000-memory.dmp

Filesize
64KB

Download