redline | c9bc63e8b77037c4faaf0fb5e39689924133d16dedc4dba484b39789462926fe

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 09:28

Target

RFQ#00358-QUANTUM MACH.exe
Size

2.4MB
MD5

f4d943387bf5915c1703a7067befb640
SHA1

1c66a240492257e4ee294a2889bf1daf2b44ad01
SHA256

c9bc63e8b77037c4faaf0fb5e39689924133d16dedc4dba484b39789462926fe
SHA512

a9bacbd2066d3f7f48ba8ab71e6cafab0236cbb3e25d50e47df7eb10a81033400b056475d70c2ca332a8efc736ab374fe71682a9eeb4cf41b86d22166b318321
SSDEEP

12288:GB55LGJHP0k6QGixiOM1tuMVFynYjetCnzLAoZ9PpQdH:GdGJHtJLiOM1tZUYZz8on+H

Score

10^/10

Family

redline

Botnet

halle

194.55.186.180:55123

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3864-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3864-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ#00358-QUANTUM MACH.exe

description pid process target process

PID 212 set thread context of 3864 212 RFQ#00358-QUANTUM MACH.exe jsc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

jsc.exe

description pid process

Token: SeDebugPrivilege 3864 jsc.exe

description	pid	process	target process
PID 212 set thread context of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe

description	pid	process
Token: SeDebugPrivilege	3864	jsc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

RFQ#00358-QUANTUM MACH.exe

description	pid	process	target process
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 3864	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 2828	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 2828	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe
PID 212 wrote to memory of 2828	212	RFQ#00358-QUANTUM MACH.exe	jsc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4584,i,4226873509039249198,15952596839998010243,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:8
1⤵
PID:1104

memory/212-7-0x00007FFE06B80000-0x00007FFE07641000-memory.dmp

Filesize
10.8MB

Download
memory/212-1-0x00000276417D0000-0x0000027641810000-memory.dmp

Filesize
256KB

Download
memory/212-2-0x000002765CC90000-0x000002765CCD0000-memory.dmp

Filesize
256KB

Download
memory/212-3-0x000002765BE00000-0x000002765BE70000-memory.dmp

Filesize
448KB

Download
memory/212-4-0x00007FFE06B80000-0x00007FFE07641000-memory.dmp

Filesize
10.8MB

Download
memory/212-0-0x00007FFE06B83000-0x00007FFE06B85000-memory.dmp

Filesize
8KB

Download
memory/3864-8-0x0000000006000000-0x0000000006618000-memory.dmp

Filesize
6.1MB

Download
memory/3864-6-0x000000007503E000-0x000000007503F000-memory.dmp

Filesize
4KB

Download
memory/3864-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3864-9-0x0000000005910000-0x0000000005922000-memory.dmp

Filesize
72KB

Download
memory/3864-10-0x00000000059E0000-0x0000000005A1C000-memory.dmp

Filesize
240KB

Download
memory/3864-11-0x0000000005970000-0x00000000059BC000-memory.dmp

Filesize
304KB

Download
memory/3864-12-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/3864-13-0x0000000005C60000-0x0000000005D6A000-memory.dmp

Filesize
1.0MB

Download
memory/3864-14-0x000000007503E000-0x000000007503F000-memory.dmp

Filesize
4KB

Download
memory/3864-15-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download