redline | 3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4

Resubmissions

29/05/2024, 19:19

240529-x1mdvsff69 10

29/05/2024, 15:30

240529-sxgxrabc59 10

Analysis

max time kernel
109s
max time network
111s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/05/2024, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
Size

523KB
MD5

e336cd749eb4e599192906f8d61d0bb2
SHA1

6d431812efb3c52e0bdd44d2602bca486eacc451
SHA256

3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4
SHA512

8e18ce1501dbf77ca2af6cf6d7c0813501b2e94c61e859878370e872c93b79d7019430391b4916296e7f62079d2408a37ff0cdab0260d67b437eb88310d1fb84
SSDEEP

12288:5cO61A772/5RMH4Gj63oiwKeWq6GXiS+qdYYn86v:U+XQRMYGSFFq6G53nv

Score

10^/10

redline sectoprat xxl infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

xxl

2.56.59.101:17559

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4384-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/4384-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 352 set thread context of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
Token: SeDebugPrivilege	4384	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 4884	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	75
PID 352 wrote to memory of 4884	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	75
PID 352 wrote to memory of 4884	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	75
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76
PID 352 wrote to memory of 4384	352	3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe	76

C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
"C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352
- C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
  "C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe"
  2⤵
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe
  "C:\Users\Admin\AppData\Local\Temp\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3bd982f82a1b2f074b02fe7cc7413f1e083f19108ae2612b2b5a741a9858f7f4.exe.log

Filesize
1KB

MD5
12557ab909651a6f99d3503d614d3562

SHA1
b86745768059a514bea3a438e1e96086af463246

SHA256
9589c869703e95d40d5870c60f66d8460f7914e9fe8dd579533c84148112babd

SHA512
10cdb2fa7cf054af937b4aeddfe16fe755d6b09db5a51f7052adbf472b4b435e16c141f3712762f3b67f990c3efcfa47659576988e321214c747d6cd98e75521

Download Submit
memory/352-12-0x00000000085C0000-0x00000000085DE000-memory.dmp

Filesize
120KB

Download
memory/352-9-0x0000000008480000-0x000000000851C000-memory.dmp

Filesize
624KB

Download
memory/352-3-0x0000000005950000-0x00000000059E2000-memory.dmp

Filesize
584KB

Download
memory/352-4-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/352-5-0x0000000073090000-0x000000007377E000-memory.dmp

Filesize
6.9MB

Download
memory/352-6-0x0000000005B00000-0x0000000005B16000-memory.dmp

Filesize
88KB

Download
memory/352-7-0x000000007309E000-0x000000007309F000-memory.dmp

Filesize
4KB

Download
memory/352-16-0x0000000073090000-0x000000007377E000-memory.dmp

Filesize
6.9MB

Download
memory/352-0-0x000000007309E000-0x000000007309F000-memory.dmp

Filesize
4KB

Download
memory/352-10-0x0000000008520000-0x000000000859C000-memory.dmp

Filesize
496KB

Download
memory/352-2-0x0000000005DB0000-0x00000000062AE000-memory.dmp

Filesize
5.0MB

Download
memory/352-11-0x0000000008620000-0x0000000008686000-memory.dmp

Filesize
408KB

Download
memory/352-8-0x0000000073090000-0x000000007377E000-memory.dmp

Filesize
6.9MB

Download
memory/352-1-0x0000000000FF0000-0x0000000001078000-memory.dmp

Filesize
544KB

Download
memory/4384-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4384-18-0x0000000005A60000-0x0000000006066000-memory.dmp

Filesize
6.0MB

Download
memory/4384-17-0x0000000073090000-0x000000007377E000-memory.dmp

Filesize
6.9MB

Download
memory/4384-20-0x0000000005360000-0x000000000539E000-memory.dmp

Filesize
248KB

Download
memory/4384-19-0x0000000005300000-0x0000000005312000-memory.dmp

Filesize
72KB

Download
memory/4384-21-0x00000000053A0000-0x00000000053EB000-memory.dmp

Filesize
300KB

Download
memory/4384-22-0x0000000073090000-0x000000007377E000-memory.dmp

Filesize
6.9MB

Download
memory/4384-23-0x0000000005610000-0x000000000571A000-memory.dmp

Filesize
1.0MB

Download
memory/4384-24-0x0000000073090000-0x000000007377E000-memory.dmp

Filesize
6.9MB

Download