redline | f224b56301de1b40dd9929e88dacc5f0519723570c822f8ed5971da3e2b88200

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 20:17

Target

bcb5ce25375eea94a691f11146f5014e.exe
Size

278KB
MD5

bcb5ce25375eea94a691f11146f5014e
SHA1

390833d4e888b8a67c39d1988b880ab2adefa6a1
SHA256

f224b56301de1b40dd9929e88dacc5f0519723570c822f8ed5971da3e2b88200
SHA512

ca466f8728d730e6f13619b8789d8363ebb273bd8526cf01c6efdea27848a642d47c4b5ea918b8f75f40fc36a32888cb7b678e1e603b0e15ffcc29f8fde996b6
SSDEEP

6144:tLyPUeEbc7FSm8QJupM64r4ZXKbInVZTc/mfM:txLoF8Qoa6atK

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1908-3-0x00000000003E0000-0x0000000000400000-memory.dmp	family_redline
behavioral1/memory/1908-5-0x0000000007250000-0x0000000007290000-memory.dmp	family_redline
behavioral1/memory/1908-9-0x0000000004690000-0x00000000046AE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1908-3-0x00000000003E0000-0x0000000000400000-memory.dmp	family_sectoprat
behavioral1/memory/1908-5-0x0000000007250000-0x0000000007290000-memory.dmp	family_sectoprat
behavioral1/memory/1908-9-0x0000000004690000-0x00000000046AE000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bcb5ce25375eea94a691f11146f5014e.exe

description pid process

Token: SeDebugPrivilege 1908 bcb5ce25375eea94a691f11146f5014e.exe

description	pid	process
Token: SeDebugPrivilege	1908	bcb5ce25375eea94a691f11146f5014e.exe

C:\Users\Admin\AppData\Local\Temp\bcb5ce25375eea94a691f11146f5014e.exe
"C:\Users\Admin\AppData\Local\Temp\bcb5ce25375eea94a691f11146f5014e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908

memory/1908-1-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/1908-2-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1908-4-0x0000000000400000-0x0000000002CD3000-memory.dmp

Filesize
40.8MB

Download
memory/1908-3-0x00000000003E0000-0x0000000000400000-memory.dmp

Filesize
128KB

Download
memory/1908-5-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/1908-6-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/1908-8-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/1908-7-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/1908-9-0x0000000004690000-0x00000000046AE000-memory.dmp

Filesize
120KB

Download
memory/1908-11-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/1908-12-0x00000000002A0000-0x00000000002CF000-memory.dmp

Filesize
188KB

Download
memory/1908-13-0x0000000007250000-0x0000000007290000-memory.dmp

Filesize
256KB

Download
memory/1908-14-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download