Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
184d122b490b7ddd40bb242632966c12.exe
Resource
win7-20231215-en
General
-
Target
184d122b490b7ddd40bb242632966c12.exe
-
Size
210KB
-
MD5
184d122b490b7ddd40bb242632966c12
-
SHA1
52eeebcb30a95c2ba34d6c9c82154bcd07e61bbc
-
SHA256
085a46a11e5f51719ad5621e6d3595befbb01ab0f7a88277a4e923e414d41700
-
SHA512
b226a77270a98676479c9e713dee35b5c3e28288d2d1e316dec7888d557579d9233808321e873d80b4fdb52deac19d049de1ee98c22577a40df27b628c0fe875
-
SSDEEP
3072:g+cs070z8krSQCRdEf9J862EnbWjHPVgbZqL8dQgLq2WqxrztDw:pcs07M8krSQC7Ex0HtyqwdQgLbrhw
Malware Config
Extracted
redline
pro2
95.217.122.120:8374
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/2712-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/2712-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4924 set thread context of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4924 184d122b490b7ddd40bb242632966c12.exe Token: SeDebugPrivilege 2712 184d122b490b7ddd40bb242632966c12.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100 PID 4924 wrote to memory of 2712 4924 184d122b490b7ddd40bb242632966c12.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe"C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exeC:\Users\Admin\AppData\Local\Temp\184d122b490b7ddd40bb242632966c12.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\184d122b490b7ddd40bb242632966c12.exe.log
Filesize605B
MD53654bd2c6957761095206ffdf92b0cb9
SHA16f10f7b5867877de7629afcff644c265e79b4ad3
SHA256c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4
SHA512e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79