Overview

overview

10

Static

static

10

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2023 14:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    95KB

  • MD5

    536a198ea9f67dc3403b894d2e4e5fc4

  • SHA1

    82ca68f5d10ab1baeeaae042bb0fac595db10ea0

  • SHA256

    5112ff1b75d9c33d10efafcbacdb4e2116280c1f5f3e6b6a64b44279997d96ee

  • SHA512

    de8fd56a76b64076ee66ee69b361f2616f8fc668f819b4173e824568844d872e9782ac7d210bc69703d373e19fe9e43bff61668f904238e8899aa1f5a782f768

  • SSDEEP

    1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed243teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdGY

Score
10/10
redlinesectopratcheatinfostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

135.148.89.82:60386

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/272-54-0x0000000000390000-0x00000000003AE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/272-55-0x00000000049B0000-0x00000000049F0000-memory.dmp
    Filesize

    256KB

    Download