redline | 3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4

Resubmissions

29-05-2024 19:19

240529-x1mdvsff69 10

29-05-2024 15:30

240529-sxgxrabc59 10

Analysis

max time kernel
124s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
Size

523KB
MD5

e336cd749eb4e599192906f8d61d0bb2
SHA1

6d431812efb3c52e0bdd44d2602bca486eacc451
SHA256

3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4
SHA512

8e18ce1501dbf77ca2af6cf6d7c0813501b2e94c61e859878370e872c93b79d7019430391b4916296e7f62079d2408a37ff0cdab0260d67b437eb88310d1fb84
SSDEEP

12288:5cO61A772/5RMH4Gj63oiwKeWq6GXiS+qdYYn86v:U+XQRMYGSFFq6G53nv

Score

10^/10

redline sectoprat xxl infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

xxl

2.56.59.101:17559

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2236-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2236-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2236-10-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2236-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2236-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2236-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2236-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2236-10-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2236-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2236-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 360 set thread context of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28
PID 360 wrote to memory of 2236	360	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	28

C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
"C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:360
- C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
  "C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/360-1-0x0000000000230000-0x00000000002B8000-memory.dmp

Filesize
544KB

Download
memory/360-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/360-3-0x00000000002F0000-0x0000000000306000-memory.dmp

Filesize
88KB

Download
memory/360-4-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/360-5-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/360-6-0x0000000005D00000-0x0000000005D7C000-memory.dmp

Filesize
496KB

Download
memory/360-7-0x00000000006D0000-0x00000000006EE000-memory.dmp

Filesize
120KB

Download
memory/360-20-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2236-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-21-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-22-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-23-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download