Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 23:13

General

  • Target

    18851ac1b5161ebdb1b2cf9a9e69ffaa.exe

  • Size

    289KB

  • MD5

    18851ac1b5161ebdb1b2cf9a9e69ffaa

  • SHA1

    7e1ad712092fa0244618d63cbc40ee0a905310bd

  • SHA256

    2cb5d586b1e5511df8134203c1533d3d49107f53c84156cb3f0083c9d75dd0b0

  • SHA512

    eb3d79b17da3109d199d34ff4abe914551305e481e75b38f3fa9d87e67451898dea1e048655f6d7bc7522d2392fbcc145221128a9c2e183a296ed965f64f2436

  • SSDEEP

    3072:2xmocnUDJX69gbucyzd8SnvmMWmku5+GwZWtFchWdwL4Rzql:pnUF6yZy+Ygu+hItFA4Ru

Malware Config

Extracted

Family

redline

Botnet

NetFramework

C2

yonicathal.xyz:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18851ac1b5161ebdb1b2cf9a9e69ffaa.exe
    "C:\Users\Admin\AppData\Local\Temp\18851ac1b5161ebdb1b2cf9a9e69ffaa.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1984

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1984-0-0x0000000000200000-0x000000000024E000-memory.dmp

          Filesize

          312KB

        • memory/1984-1-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1984-2-0x0000000005160000-0x0000000005778000-memory.dmp

          Filesize

          6.1MB

        • memory/1984-3-0x0000000004BF0000-0x0000000004C02000-memory.dmp

          Filesize

          72KB

        • memory/1984-4-0x0000000004C50000-0x0000000004C8C000-memory.dmp

          Filesize

          240KB

        • memory/1984-5-0x0000000004D40000-0x0000000004D50000-memory.dmp

          Filesize

          64KB

        • memory/1984-6-0x0000000004C90000-0x0000000004CDC000-memory.dmp

          Filesize

          304KB

        • memory/1984-7-0x0000000004F00000-0x000000000500A000-memory.dmp

          Filesize

          1.0MB

        • memory/1984-8-0x0000000074650000-0x0000000074E00000-memory.dmp

          Filesize

          7.7MB

        • memory/1984-9-0x0000000004D40000-0x0000000004D50000-memory.dmp

          Filesize

          64KB