redline | 0930b9b14719ac06b5b7153b68ae2d32b4e4f5007a6314f06465b8ffc0c99698

Analysis

max time kernel
141s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 20:11

Target

900b814cafca092d94d11fe5770b7a79.exe
Size

289KB
MD5

900b814cafca092d94d11fe5770b7a79
SHA1

36d3a9f19fa9ddea3e45b388daf80e00e920572e
SHA256

0930b9b14719ac06b5b7153b68ae2d32b4e4f5007a6314f06465b8ffc0c99698
SHA512

e1e61438ff7ee65782e1158f31a3a688ed07a1fff23d1af5a3df84f1c66228fe623fd6a431d41fc589fe2e2c2fe53aa9385d7954c79e4a81e0d07f9e8c4569fe
SSDEEP

3072:JASSQE+JsLrP8vZllaWT+BCoUaO+vsbMC2gNXtzgZZBcIgCaxRm7BNSkRbQuKT0M:Jtgmxf+Mode2+Xt2ZBctw6lbpJbZ

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-3-0x0000000002D90000-0x0000000002DB0000-memory.dmp	family_redline
behavioral1/memory/2036-7-0x0000000002E20000-0x0000000002E3E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-3-0x0000000002D90000-0x0000000002DB0000-memory.dmp	family_sectoprat
behavioral1/memory/2036-7-0x0000000002E20000-0x0000000002E3E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

900b814cafca092d94d11fe5770b7a79.exe

description pid process

Token: SeDebugPrivilege 2036 900b814cafca092d94d11fe5770b7a79.exe

description	pid	process
Token: SeDebugPrivilege	2036	900b814cafca092d94d11fe5770b7a79.exe

C:\Users\Admin\AppData\Local\Temp\900b814cafca092d94d11fe5770b7a79.exe
"C:\Users\Admin\AppData\Local\Temp\900b814cafca092d94d11fe5770b7a79.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

memory/2036-2-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/2036-1-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2036-4-0x0000000000400000-0x0000000002CD7000-memory.dmp

Filesize
40.8MB

Download
memory/2036-3-0x0000000002D90000-0x0000000002DB0000-memory.dmp

Filesize
128KB

Download
memory/2036-6-0x0000000007170000-0x00000000071B0000-memory.dmp

Filesize
256KB

Download
memory/2036-5-0x0000000007170000-0x00000000071B0000-memory.dmp

Filesize
256KB

Download
memory/2036-7-0x0000000002E20000-0x0000000002E3E000-memory.dmp

Filesize
120KB

Download
memory/2036-8-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-10-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2036-12-0x0000000007170000-0x00000000071B0000-memory.dmp

Filesize
256KB

Download
memory/2036-13-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download