redline | 54b01a0bef3bc887868b07bd5e000004ff4368c5182fe52993bac7c43d47920f

Analysis

max time kernel
141s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-02-2024 02:17

Target

93942198accc993f670296b08281adce.exe
Size

316KB
MD5

93942198accc993f670296b08281adce
SHA1

6863171eac609c0f85cef68592f0233a700a560f
SHA256

54b01a0bef3bc887868b07bd5e000004ff4368c5182fe52993bac7c43d47920f
SHA512

ae6dbf2bd93f58ae8e09d287656d29eecfccc7926c5b827d8003f0f4ad693c980f1eb2f5bccddab3169fd94d5942a95d4de18e766f3e66c960222e32e97a3d66
SSDEEP

6144:QXA9aNGQBZury7+u0LAW0mEEWJSCIwY8:QX0QignsYSC5

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/860-2-0x0000000000380000-0x00000000003A0000-memory.dmp	family_redline
behavioral1/memory/860-9-0x0000000007250000-0x0000000007290000-memory.dmp	family_redline
behavioral1/memory/860-8-0x0000000004630000-0x000000000464E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/860-2-0x0000000000380000-0x00000000003A0000-memory.dmp	family_sectoprat
behavioral1/memory/860-9-0x0000000007250000-0x0000000007290000-memory.dmp	family_sectoprat
behavioral1/memory/860-8-0x0000000004630000-0x000000000464E000-memory.dmp	family_sectoprat
behavioral1/memory/860-10-0x0000000007250000-0x0000000007290000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

93942198accc993f670296b08281adce.exe

description pid process

Token: SeDebugPrivilege 860 93942198accc993f670296b08281adce.exe

description	pid	process
Token: SeDebugPrivilege	860	93942198accc993f670296b08281adce.exe

C:\Users\Admin\AppData\Local\Temp\93942198accc993f670296b08281adce.exe
"C:\Users\Admin\AppData\Local\Temp\93942198accc993f670296b08281adce.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:860

memory/860-1-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/860-2-0x0000000000380000-0x00000000003A0000-memory.dmp

Filesize
128KB

Download
memory/860-3-0x0000000000400000-0x0000000002C85000-memory.dmp

Filesize
40.5MB

Download
memory/860-6-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/860-5-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/860-4-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/860-7-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/860-9-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/860-8-0x0000000004630000-0x000000000464E000-memory.dmp

Filesize
120KB

Download
memory/860-10-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/860-12-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/860-14-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/860-13-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/860-15-0x0000000074070000-0x000000007475E000-memory.dmp

Filesize
6.9MB

Download
memory/860-17-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download