redline | 1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:10

Target

1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe
Size

1.0MB
MD5

715d0979fbadb19889e7963f7c33f501
SHA1

3ad746befebb85f942868a1f5338cb4e36f355e1
SHA256

1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5
SHA512

639a322cf569f6d8aeb03c4ddfc8db30f81cc13ab0f3ec1fa19f644c88393adfac24964392c61b0ec213499fd5603b9d51af240aba447226b4357ff8c4571d8a
SSDEEP

24576:7AHnh+eWsN3skA4RV1Hom2KXMmHa7cGNS5Z5:Wh+ZkldoPK8Ya7crx

Score

10^/10

Family

redline

Botnet

french

91.92.243.245:47477

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2704-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2704-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2704-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2704-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2704-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2704-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe

description	pid	process	target process
PID 3056 set thread context of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe

pid process

3056 1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2704 RegSvcs.exe

pid	process
3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe

description	pid	process
Token: SeDebugPrivilege	2704	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe

description	pid	process	target process
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe
PID 3056 wrote to memory of 2704	3056	1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704

memory/2704-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2704-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2704-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2704-16-0x0000000073B8E000-0x0000000073B8F000-memory.dmp

Filesize
4KB

Download
memory/2704-17-0x0000000073B80000-0x000000007426E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-18-0x0000000073B8E000-0x0000000073B8F000-memory.dmp

Filesize
4KB

Download
memory/2704-19-0x0000000073B80000-0x000000007426E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-10-0x0000000000150000-0x0000000000154000-memory.dmp

Filesize
16KB

Download