Analysis

  • max time kernel
    213s
  • max time network
    246s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 23:09

General

  • Target

    184d122b490b7ddd40bb242632966c12.exe

  • Size

    210KB

  • MD5

    184d122b490b7ddd40bb242632966c12

  • SHA1

    52eeebcb30a95c2ba34d6c9c82154bcd07e61bbc

  • SHA256

    085a46a11e5f51719ad5621e6d3595befbb01ab0f7a88277a4e923e414d41700

  • SHA512

    b226a77270a98676479c9e713dee35b5c3e28288d2d1e316dec7888d557579d9233808321e873d80b4fdb52deac19d049de1ee98c22577a40df27b628c0fe875

  • SSDEEP

    3072:g+cs070z8krSQCRdEf9J862EnbWjHPVgbZqL8dQgLq2WqxrztDw:pcs07M8krSQC7Ex0HtyqwdQgLbrhw

Malware Config

Extracted

Family

redline

Botnet

pro2

C2

95.217.122.120:8374

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe
    "C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe
      C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2180

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2180-8-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2180-14-0x0000000004BC0000-0x0000000004C00000-memory.dmp

          Filesize

          256KB

        • memory/2180-13-0x0000000074680000-0x0000000074D6E000-memory.dmp

          Filesize

          6.9MB

        • memory/2180-12-0x0000000004BC0000-0x0000000004C00000-memory.dmp

          Filesize

          256KB

        • memory/2180-11-0x0000000074680000-0x0000000074D6E000-memory.dmp

          Filesize

          6.9MB

        • memory/2180-5-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2180-10-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/3060-3-0x0000000004730000-0x0000000004770000-memory.dmp

          Filesize

          256KB

        • memory/3060-7-0x0000000074D70000-0x000000007545E000-memory.dmp

          Filesize

          6.9MB

        • memory/3060-4-0x0000000000440000-0x0000000000454000-memory.dmp

          Filesize

          80KB

        • memory/3060-0-0x0000000074D70000-0x000000007545E000-memory.dmp

          Filesize

          6.9MB

        • memory/3060-2-0x0000000074D70000-0x000000007545E000-memory.dmp

          Filesize

          6.9MB

        • memory/3060-1-0x0000000000210000-0x0000000000248000-memory.dmp

          Filesize

          224KB