Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 15:48
Static task
static1
Behavioral task
behavioral1
Sample
dd751eca5c3bf3e51c717ce8da809c75.exe
Resource
win7-20231129-en
General
-
Target
dd751eca5c3bf3e51c717ce8da809c75.exe
-
Size
781KB
-
MD5
dd751eca5c3bf3e51c717ce8da809c75
-
SHA1
8a66b16807fe11fd3502012dd667e3e5a5670a4c
-
SHA256
c6aa9a4f5479081e68ab9f49c0c994f7d794a21d27d32048c6b16e1495653235
-
SHA512
d642c6e29c22791314f87f280b98130730af8e18ea3f7d725ebeff77010b4db556395949556cec20230541dad9e976eae852185d54402123dd57bb7712efba73
-
SSDEEP
12288:y1AMrB0OBKyqZjUA8k5J9Jkztifb6cgocJPim48MY5iXFZuf/HnuTN7PqnCks7:yXFfjJPi7rLXufGTN7PRkE
Malware Config
Extracted
redline
10
usersoft-usa.info:80
-
auth_value
df36234d4b97493c0b28f7ce2170085d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2216-0-0x00000000005E0000-0x0000000000611000-memory.dmp family_redline behavioral1/memory/2216-9-0x0000000004EF0000-0x0000000004F30000-memory.dmp family_redline behavioral1/memory/2216-7-0x00000000021B0000-0x00000000021D2000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2216-0-0x00000000005E0000-0x0000000000611000-memory.dmp family_sectoprat behavioral1/memory/2216-9-0x0000000004EF0000-0x0000000004F30000-memory.dmp family_sectoprat behavioral1/memory/2216-7-0x00000000021B0000-0x00000000021D2000-memory.dmp family_sectoprat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-0-0x00000000005E0000-0x0000000000611000-memory.dmpFilesize
196KB
-
memory/2216-10-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB
-
memory/2216-9-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB
-
memory/2216-8-0x0000000074150000-0x000000007483E000-memory.dmpFilesize
6.9MB
-
memory/2216-7-0x00000000021B0000-0x00000000021D2000-memory.dmpFilesize
136KB
-
memory/2216-11-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2216-12-0x0000000074150000-0x000000007483E000-memory.dmpFilesize
6.9MB
-
memory/2216-14-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB