Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
1a57bf71f1863522e92c5dc2c0efdb7a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1a57bf71f1863522e92c5dc2c0efdb7a.exe
Resource
win10v2004-20231215-en
General
-
Target
1a57bf71f1863522e92c5dc2c0efdb7a.exe
-
Size
365KB
-
MD5
1a57bf71f1863522e92c5dc2c0efdb7a
-
SHA1
90763a9de48c62a03614e0ee4b4b368aa665d5e7
-
SHA256
554a25e7d368633e1a8423949834119eaa6cb812e49b9968004ea0421c538442
-
SHA512
4921a1aad6aa116273b117bc0dba522efea0631528c37c7a29cfd22ece6295badff1995a6a17b4ec7f7ba06776cac632e388240500989e6844e9551d3cd83295
-
SSDEEP
6144:k73LvCkrKRjYzEIL1ET9SNgwqbtm58YKYmmZ:kLLvxrKRj1IL1ET9SNgwstm58YKYmmZ
Malware Config
Extracted
redline
@nondontinfo
188.130.139.12:23747
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2368-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2368-5-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2368-9-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2368-13-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2368-11-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2368-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2368-5-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2368-9-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2368-13-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2368-11-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1756 set thread context of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2368 1a57bf71f1863522e92c5dc2c0efdb7a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29 PID 1756 wrote to memory of 2368 1756 1a57bf71f1863522e92c5dc2c0efdb7a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe"C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exeC:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368
-