Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 15:48
Static task
static1
Behavioral task
behavioral1
Sample
dd751eca5c3bf3e51c717ce8da809c75.exe
Resource
win7-20231129-en
General
-
Target
dd751eca5c3bf3e51c717ce8da809c75.exe
-
Size
781KB
-
MD5
dd751eca5c3bf3e51c717ce8da809c75
-
SHA1
8a66b16807fe11fd3502012dd667e3e5a5670a4c
-
SHA256
c6aa9a4f5479081e68ab9f49c0c994f7d794a21d27d32048c6b16e1495653235
-
SHA512
d642c6e29c22791314f87f280b98130730af8e18ea3f7d725ebeff77010b4db556395949556cec20230541dad9e976eae852185d54402123dd57bb7712efba73
-
SSDEEP
12288:y1AMrB0OBKyqZjUA8k5J9Jkztifb6cgocJPim48MY5iXFZuf/HnuTN7PqnCks7:yXFfjJPi7rLXufGTN7PRkE
Malware Config
Extracted
redline
10
usersoft-usa.info:80
-
auth_value
df36234d4b97493c0b28f7ce2170085d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4320-0-0x0000000000EC0000-0x0000000000EF1000-memory.dmp family_redline behavioral2/memory/4320-7-0x0000000002AD0000-0x0000000002AF2000-memory.dmp family_redline -
SectopRAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4320-0-0x0000000000EC0000-0x0000000000EF1000-memory.dmp family_sectoprat behavioral2/memory/4320-7-0x0000000002AD0000-0x0000000002AF2000-memory.dmp family_sectoprat behavioral2/memory/4320-19-0x0000000005340000-0x0000000005350000-memory.dmp family_sectoprat behavioral2/memory/4320-20-0x0000000005340000-0x0000000005350000-memory.dmp family_sectoprat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4320-0-0x0000000000EC0000-0x0000000000EF1000-memory.dmpFilesize
196KB
-
memory/4320-7-0x0000000002AD0000-0x0000000002AF2000-memory.dmpFilesize
136KB
-
memory/4320-8-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4320-9-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4320-10-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4320-11-0x0000000005350000-0x0000000005968000-memory.dmpFilesize
6.1MB
-
memory/4320-12-0x0000000005300000-0x0000000005312000-memory.dmpFilesize
72KB
-
memory/4320-13-0x00000000059B0000-0x0000000005ABA000-memory.dmpFilesize
1.0MB
-
memory/4320-14-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4320-15-0x0000000005AC0000-0x0000000005AFC000-memory.dmpFilesize
240KB
-
memory/4320-16-0x0000000005B20000-0x0000000005B6C000-memory.dmpFilesize
304KB
-
memory/4320-17-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/4320-18-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4320-19-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4320-20-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4320-22-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/4320-23-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB