redline | b33bc799128d0e630270f09393c5f4dae1867782fbde21db3d7f6d5f945625d2

Analysis

max time kernel
128s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 16:29

Target

b7db02446d1f0cc21a2259227b021313.exe
Size

262KB
MD5

b7db02446d1f0cc21a2259227b021313
SHA1

77099382728356ad71d80226c90754a75e29fb06
SHA256

b33bc799128d0e630270f09393c5f4dae1867782fbde21db3d7f6d5f945625d2
SHA512

10ab722f5369e22357530ab73e6416e4ed616ffd5c29ea3f520b5830bd316e5ec9689c588ba95288dc09a0cc4c840c6abeb2c84823839606dc029a9f6d0c94e0
SSDEEP

6144:Sw+HQu1he+ERDoXJpGur3sKP2V9lVp5c8h:CB1he+bZXr3sKPsxc8h

Score

10^/10

Family

redline

Botnet

youngboy

176.57.69.178:59510

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2648-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2648-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2648-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2648-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

b7db02446d1f0cc21a2259227b021313.exe

description pid process target process

PID 2368 set thread context of 2648 2368 b7db02446d1f0cc21a2259227b021313.exe b7db02446d1f0cc21a2259227b021313.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b7db02446d1f0cc21a2259227b021313.exeb7db02446d1f0cc21a2259227b021313.exe

description pid process

Token: SeDebugPrivilege 2368 b7db02446d1f0cc21a2259227b021313.exe
Token: SeDebugPrivilege 2648 b7db02446d1f0cc21a2259227b021313.exe

description	pid	process	target process
PID 2368 set thread context of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe

description	pid	process
Token: SeDebugPrivilege	2368	b7db02446d1f0cc21a2259227b021313.exe
Token: SeDebugPrivilege	2648	b7db02446d1f0cc21a2259227b021313.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b7db02446d1f0cc21a2259227b021313.exe

description	pid	process	target process
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe
PID 2368 wrote to memory of 2648	2368	b7db02446d1f0cc21a2259227b021313.exe	b7db02446d1f0cc21a2259227b021313.exe

C:\Users\Admin\AppData\Local\Temp\b7db02446d1f0cc21a2259227b021313.exe
C:\Users\Admin\AppData\Local\Temp\b7db02446d1f0cc21a2259227b021313.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648

memory/2368-0-0x00000000009A0000-0x00000000009E4000-memory.dmp

Filesize
272KB

Download
memory/2368-1-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2368-2-0x0000000000860000-0x00000000008A0000-memory.dmp

Filesize
256KB

Download
memory/2368-3-0x0000000000300000-0x0000000000320000-memory.dmp

Filesize
128KB

Download
memory/2368-6-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-10-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-11-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/2648-12-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download