Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
1a57bf71f1863522e92c5dc2c0efdb7a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1a57bf71f1863522e92c5dc2c0efdb7a.exe
Resource
win10v2004-20231215-en
General
-
Target
1a57bf71f1863522e92c5dc2c0efdb7a.exe
-
Size
365KB
-
MD5
1a57bf71f1863522e92c5dc2c0efdb7a
-
SHA1
90763a9de48c62a03614e0ee4b4b368aa665d5e7
-
SHA256
554a25e7d368633e1a8423949834119eaa6cb812e49b9968004ea0421c538442
-
SHA512
4921a1aad6aa116273b117bc0dba522efea0631528c37c7a29cfd22ece6295badff1995a6a17b4ec7f7ba06776cac632e388240500989e6844e9551d3cd83295
-
SSDEEP
6144:k73LvCkrKRjYzEIL1ET9SNgwqbtm58YKYmmZ:kLLvxrKRj1IL1ET9SNgwstm58YKYmmZ
Malware Config
Extracted
redline
@nondontinfo
188.130.139.12:23747
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3272-5-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/3272-5-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5000 set thread context of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3272 1a57bf71f1863522e92c5dc2c0efdb7a.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5000 wrote to memory of 2552 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 92 PID 5000 wrote to memory of 2552 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 92 PID 5000 wrote to memory of 2552 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 92 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93 PID 5000 wrote to memory of 3272 5000 1a57bf71f1863522e92c5dc2c0efdb7a.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe"C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exeC:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe2⤵PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exeC:\Users\Admin\AppData\Local\Temp\1a57bf71f1863522e92c5dc2c0efdb7a.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272
-