redline | f56754d0ccbe9b6c1a87886645569d53a8a04393848e228abe0a6d0a8ec79842

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 03:34

Target

c4deca234ca24bba1ca5bbb8e632f787.exe
Size

323KB
MD5

c4deca234ca24bba1ca5bbb8e632f787
SHA1

84321124fe17b2dd91704e4126709a41c0e5f342
SHA256

f56754d0ccbe9b6c1a87886645569d53a8a04393848e228abe0a6d0a8ec79842
SHA512

3ee6fe7e45f9a333b7a2c9150a7db8f85a258f7cfa6cbd2ce6d8d679eab5fccf00f3986ab54bbbc156ee377dc1198d79816aaac059bcbc10941b7745ca64c85e
SSDEEP

6144:ZcFFQMWM20dEUaMgLK244aZLnIwdXqfMARBPAnpQx5AH:ZTK20dhgK1KfbRBPAi

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3044-4-0x0000000000CD0000-0x0000000000CF0000-memory.dmp	family_redline
behavioral1/memory/3044-9-0x0000000002300000-0x000000000231E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3044-4-0x0000000000CD0000-0x0000000000CF0000-memory.dmp	family_sectoprat
behavioral1/memory/3044-9-0x0000000002300000-0x000000000231E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c4deca234ca24bba1ca5bbb8e632f787.exe

description pid process

Token: SeDebugPrivilege 3044 c4deca234ca24bba1ca5bbb8e632f787.exe

description	pid	process
Token: SeDebugPrivilege	3044	c4deca234ca24bba1ca5bbb8e632f787.exe

C:\Users\Admin\AppData\Local\Temp\c4deca234ca24bba1ca5bbb8e632f787.exe
"C:\Users\Admin\AppData\Local\Temp\c4deca234ca24bba1ca5bbb8e632f787.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044

memory/3044-2-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/3044-3-0x0000000000A50000-0x0000000000A7F000-memory.dmp

Filesize
188KB

Download
memory/3044-1-0x0000000000D00000-0x0000000000E00000-memory.dmp

Filesize
1024KB

Download
memory/3044-5-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-8-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/3044-7-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/3044-6-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/3044-4-0x0000000000CD0000-0x0000000000CF0000-memory.dmp

Filesize
128KB

Download
memory/3044-9-0x0000000002300000-0x000000000231E000-memory.dmp

Filesize
120KB

Download
memory/3044-11-0x0000000000D00000-0x0000000000E00000-memory.dmp

Filesize
1024KB

Download
memory/3044-12-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-13-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download