redline | 9b460178a8c3bd7321e69609f53c42e088e0aa91686d4bf09a595e2c3e09fef8

Analysis

max time kernel
161s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2024 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a439295d063bc6f792782a10d8f8c1.exe
Size

324KB
MD5

d1a439295d063bc6f792782a10d8f8c1
SHA1

16e0a70a9f133961b82db3bb49c8b5bc789b3205
SHA256

9b460178a8c3bd7321e69609f53c42e088e0aa91686d4bf09a595e2c3e09fef8
SHA512

f4266222e4c24dd98b8e66b261183636a15a900c659d87000bce88b3a29bc99e6f95588c241eb5d5289c72826fb8d932449347a441a9070e7d6f7400c3fe127e
SSDEEP

6144:h4frgjiuiwMoZh6In/ba90bD6BPAnpQx5AH:h40ji8MPg/ba9sD6BPAi

Score

10^/10

redline sectoprat sewpalpadin infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

185.215.113.114:8887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3600-4-0x00000000027C0000-0x00000000027E0000-memory.dmp	family_redline
behavioral2/memory/3600-9-0x0000000004E60000-0x0000000004E7E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3600-4-0x00000000027C0000-0x00000000027E0000-memory.dmp	family_sectoprat
behavioral2/memory/3600-6-0x0000000004F70000-0x0000000004F80000-memory.dmp	family_sectoprat
behavioral2/memory/3600-9-0x0000000004E60000-0x0000000004E7E000-memory.dmp	family_sectoprat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d1a439295d063bc6f792782a10d8f8c1.exe

description pid process

Token: SeDebugPrivilege 3600 d1a439295d063bc6f792782a10d8f8c1.exe

description	pid	process
Token: SeDebugPrivilege	3600	d1a439295d063bc6f792782a10d8f8c1.exe

C:\Users\Admin\AppData\Local\Temp\d1a439295d063bc6f792782a10d8f8c1.exe
"C:\Users\Admin\AppData\Local\Temp\d1a439295d063bc6f792782a10d8f8c1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-1-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/3600-2-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/3600-3-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/3600-4-0x00000000027C0000-0x00000000027E0000-memory.dmp

Filesize
128KB

Download
memory/3600-5-0x0000000074380000-0x0000000074B30000-memory.dmp

Filesize
7.7MB

Download
memory/3600-6-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3600-7-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3600-8-0x0000000004F80000-0x0000000005524000-memory.dmp

Filesize
5.6MB

Download
memory/3600-9-0x0000000004E60000-0x0000000004E7E000-memory.dmp

Filesize
120KB

Download
memory/3600-10-0x0000000005530000-0x0000000005B48000-memory.dmp

Filesize
6.1MB

Download
memory/3600-11-0x0000000004F10000-0x0000000004F22000-memory.dmp

Filesize
72KB

Download
memory/3600-12-0x0000000004F30000-0x0000000004F6C000-memory.dmp

Filesize
240KB

Download
memory/3600-13-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3600-14-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Filesize
304KB

Download
memory/3600-15-0x0000000005D00000-0x0000000005E0A000-memory.dmp

Filesize
1.0MB

Download
memory/3600-16-0x0000000000400000-0x00000000008BB000-memory.dmp

Filesize
4.7MB

Download
memory/3600-17-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/3600-18-0x00000000024D0000-0x00000000024FF000-memory.dmp

Filesize
188KB

Download
memory/3600-19-0x0000000074380000-0x0000000074B30000-memory.dmp

Filesize
7.7MB

Download
memory/3600-21-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3600-22-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download
memory/3600-23-0x0000000004F70000-0x0000000004F80000-memory.dmp

Filesize
64KB

Download