Analysis
-
max time kernel
296s -
max time network
313s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
03-11-2023 04:11
General
-
Target
e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836.exe
-
Size
95KB
-
MD5
1199c88022b133b321ed8e9c5f4e6739
-
SHA1
8e5668edc9b4e1f15c936e68b59c84e165c9cb07
-
SHA256
e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
-
SHA512
7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697
-
SSDEEP
1536:Fqskaq+A/lbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2kteulgS6pQl:D7ZeYP+zi0ZbYe1g0ujyzd0Q
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
pixelscloud
C2
85.209.176.171:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836.exe"C:\Users\Admin\AppData\Local\Temp\e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
6.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
1.0MB
-
Filesize
6.9MB
-
Filesize
64KB