redline | 869d66bc12e637ac1050f8b2d5c48fefe370b551944cf47ba40e0ec382a673ff

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 11:49

Target

c085f044947d49c84aabd4aa3602bdf4.exe
Size

337KB
MD5

c085f044947d49c84aabd4aa3602bdf4
SHA1

be765b3452cca369848826cefa9d41ddabcdab6a
SHA256

869d66bc12e637ac1050f8b2d5c48fefe370b551944cf47ba40e0ec382a673ff
SHA512

61a6e45fbbe38ab42c05695d7d3c07e3cfcac3085eafbee90f04761d75d2c3a9d7ca9a1d3c760d70b0f9deeb24d956ae9ac45eae71cfa8183adf464a91921ad4
SSDEEP

6144:bmCNITOQaQo9P7sX8fv0sowRncun3Zg6AfiwBPAnpQx5AH:bfOyDL94X8n0sow9cu3LhwBPAi

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2320-6-0x00000000009F0000-0x0000000000A10000-memory.dmp	family_redline
behavioral1/memory/2320-8-0x00000000023A0000-0x00000000023BE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2320-6-0x00000000009F0000-0x0000000000A10000-memory.dmp	family_sectoprat
behavioral1/memory/2320-8-0x00000000023A0000-0x00000000023BE000-memory.dmp	family_sectoprat
behavioral1/memory/2320-9-0x0000000004DD0000-0x0000000004E10000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c085f044947d49c84aabd4aa3602bdf4.exe

description pid process

Token: SeDebugPrivilege 2320 c085f044947d49c84aabd4aa3602bdf4.exe

description	pid	process
Token: SeDebugPrivilege	2320	c085f044947d49c84aabd4aa3602bdf4.exe

C:\Users\Admin\AppData\Local\Temp\c085f044947d49c84aabd4aa3602bdf4.exe
"C:\Users\Admin\AppData\Local\Temp\c085f044947d49c84aabd4aa3602bdf4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

memory/2320-1-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/2320-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2320-3-0x0000000000400000-0x00000000008BE000-memory.dmp

Filesize
4.7MB

Download
memory/2320-4-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2320-5-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/2320-6-0x00000000009F0000-0x0000000000A10000-memory.dmp

Filesize
128KB

Download
memory/2320-7-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/2320-8-0x00000000023A0000-0x00000000023BE000-memory.dmp

Filesize
120KB

Download
memory/2320-9-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/2320-11-0x0000000000A10000-0x0000000000B10000-memory.dmp

Filesize
1024KB

Download
memory/2320-12-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2320-14-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/2320-15-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/2320-16-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download