Overview

overview

10

Static

static

3

5e34eb2676...38.exe

windows7-x64

10

5e34eb2676...38.exe

windows10-2004-x64

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2023 16:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5e34eb2676a17cdeec9bc5ddad2b5238.exe

  • Size

    376KB

  • MD5

    5e34eb2676a17cdeec9bc5ddad2b5238

  • SHA1

    4417ed96a124b2d03dc3f01133fd5a501f02072f

  • SHA256

    38625b7303479225387bb1d8b32118f21e60bebc4934316e2124893159c15694

  • SHA512

    473677b5cbecb48d32524018c02efac14a9ee4df30f8ab3fb2e33a2c77b98a738473e7892745274495e5e31d82b1dc9249312d84d861ea43bd8a09f598a3ffee

  • SSDEEP

    6144:5yPHikgeMBpdZO0rKVgVVzARsswjYieGiOmSyK3ONavIRzP1J:5dZOcCgVVzA8YnGiOmLK3nvIRhJ

Score
10/10
redlinesectoprat777infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

777

C2

oucesesstor.xyz:81

edaycamanel.xyz:81
Attributes
  • auth_value

    164c9110509d4287fde8e8f70e9d3b36

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e34eb2676a17cdeec9bc5ddad2b5238.exe
    "C:\Users\Admin\AppData\Local\Temp\5e34eb2676a17cdeec9bc5ddad2b5238.exe"
    1⤵
      PID:3008

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3008-1-0x0000000002EB0000-0x0000000002FB0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/3008-2-0x0000000000240000-0x0000000000270000-memory.dmp
      Filesize

      192KB

      Download
    • memory/3008-3-0x0000000000400000-0x0000000002DB6000-memory.dmp
      Filesize

      41.7MB

      Download
    • memory/3008-4-0x00000000003D0000-0x00000000003F4000-memory.dmp
      Filesize

      144KB

      Download
    • memory/3008-5-0x0000000074450000-0x0000000074B3E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3008-6-0x00000000072D0000-0x0000000007310000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3008-7-0x00000000072D0000-0x0000000007310000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3008-8-0x0000000004820000-0x0000000004842000-memory.dmp
      Filesize

      136KB

      Download
    • memory/3008-9-0x00000000072D0000-0x0000000007310000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3008-11-0x0000000002EB0000-0x0000000002FB0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/3008-13-0x0000000074450000-0x0000000074B3E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3008-14-0x00000000072D0000-0x0000000007310000-memory.dmp
      Filesize

      256KB

      Download