Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/12/2023, 16:55
General
- Target f9d8c87011a85280664db15b9561ddc0.exe
- Size 339KB
- Sample231222-vfdj4sdcf9
- SHA256 32acadd5cb9e6594707c809f7b63261b93966ace27204fc22c114d67c9196383
Malware Config
Extracted
-
redline
-
nova
-
91.142.77.129:60601
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d8c87011a85280664db15b9561ddc0.exe"C:\Users\Admin\AppData\Local\Temp\f9d8c87011a85280664db15b9561ddc0.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3348-1-0x0000000002D00000-0x0000000002E00000-memory.dmp
memory/3348-2-0x00000000048A0000-0x00000000048D0000-memory.dmp
memory/3348-3-0x0000000000400000-0x0000000002B60000-memory.dmp
memory/3348-4-0x0000000074E30000-0x00000000755E0000-memory.dmp
memory/3348-5-0x0000000004A80000-0x0000000004AA6000-memory.dmp
memory/3348-6-0x0000000007280000-0x0000000007290000-memory.dmp
memory/3348-7-0x0000000007280000-0x0000000007290000-memory.dmp
memory/3348-9-0x0000000007230000-0x0000000007254000-memory.dmp
memory/3348-8-0x0000000007290000-0x0000000007834000-memory.dmp
memory/3348-10-0x0000000007840000-0x0000000007E58000-memory.dmp
memory/3348-11-0x0000000007ED0000-0x0000000007EE2000-memory.dmp
memory/3348-12-0x0000000007EF0000-0x0000000007FFA000-memory.dmp
memory/3348-13-0x0000000007280000-0x0000000007290000-memory.dmp
memory/3348-14-0x0000000008000000-0x000000000803C000-memory.dmp
memory/3348-15-0x0000000008080000-0x00000000080CC000-memory.dmp
memory/3348-16-0x0000000002D00000-0x0000000002E00000-memory.dmp
memory/3348-17-0x0000000000400000-0x0000000002B60000-memory.dmp
memory/3348-18-0x00000000048A0000-0x00000000048D0000-memory.dmp
memory/3348-19-0x0000000074E30000-0x00000000755E0000-memory.dmp
memory/3348-21-0x0000000007280000-0x0000000007290000-memory.dmp
memory/3348-22-0x0000000007280000-0x0000000007290000-memory.dmp
memory/3348-23-0x0000000007280000-0x0000000007290000-memory.dmp