redline | 9b460178a8c3bd7321e69609f53c42e088e0aa91686d4bf09a595e2c3e09fef8

Analysis

max time kernel
154s
max time network
170s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-03-2024 19:07

Target

d1a439295d063bc6f792782a10d8f8c1.exe
Size

324KB
MD5

d1a439295d063bc6f792782a10d8f8c1
SHA1

16e0a70a9f133961b82db3bb49c8b5bc789b3205
SHA256

9b460178a8c3bd7321e69609f53c42e088e0aa91686d4bf09a595e2c3e09fef8
SHA512

f4266222e4c24dd98b8e66b261183636a15a900c659d87000bce88b3a29bc99e6f95588c241eb5d5289c72826fb8d932449347a441a9070e7d6f7400c3fe127e
SSDEEP

6144:h4frgjiuiwMoZh6In/ba90bD6BPAnpQx5AH:h40ji8MPg/ba9sD6BPAi

Score

10^/10

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2816-6-0x0000000000390000-0x00000000003B0000-memory.dmp	family_redline
behavioral1/memory/2816-7-0x0000000004E10000-0x0000000004E50000-memory.dmp	family_redline
behavioral1/memory/2816-9-0x0000000002320000-0x000000000233E000-memory.dmp	family_redline
behavioral1/memory/2816-10-0x0000000004E10000-0x0000000004E50000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2816-6-0x0000000000390000-0x00000000003B0000-memory.dmp	family_sectoprat
behavioral1/memory/2816-7-0x0000000004E10000-0x0000000004E50000-memory.dmp	family_sectoprat
behavioral1/memory/2816-9-0x0000000002320000-0x000000000233E000-memory.dmp	family_sectoprat
behavioral1/memory/2816-10-0x0000000004E10000-0x0000000004E50000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d1a439295d063bc6f792782a10d8f8c1.exe

description pid process

Token: SeDebugPrivilege 2816 d1a439295d063bc6f792782a10d8f8c1.exe

description	pid	process
Token: SeDebugPrivilege	2816	d1a439295d063bc6f792782a10d8f8c1.exe

C:\Users\Admin\AppData\Local\Temp\d1a439295d063bc6f792782a10d8f8c1.exe
"C:\Users\Admin\AppData\Local\Temp\d1a439295d063bc6f792782a10d8f8c1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

memory/2816-1-0x00000000009C0000-0x0000000000AC0000-memory.dmp

Filesize
1024KB

Download
memory/2816-2-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2816-3-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2816-4-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2816-5-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2816-6-0x0000000000390000-0x00000000003B0000-memory.dmp

Filesize
128KB

Download
memory/2816-7-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2816-8-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2816-9-0x0000000002320000-0x000000000233E000-memory.dmp

Filesize
120KB

Download
memory/2816-10-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2816-12-0x00000000009C0000-0x0000000000AC0000-memory.dmp

Filesize
1024KB

Download
memory/2816-11-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/2816-13-0x0000000000220000-0x000000000024F000-memory.dmp

Filesize
188KB

Download
memory/2816-14-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2816-15-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2816-17-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download