Analysis
- max time kernel
141s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/12/2023, 11:48
General
- Target 1bf2866754b5576e8181b118717a4781.exe
- Size 370KB
- Sample231225-nytkqagff8
- SHA256 0fb7d001e28f45c69936e416afbb84866b1d24d3c53a6f0cd3452a2272baa313
Malware Config
Extracted
-
redline
-
5k_ABSOLUTE
-
45.14.49.117:14251
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf2866754b5576e8181b118717a4781.exe"C:\Users\Admin\AppData\Local\Temp\1bf2866754b5576e8181b118717a4781.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bf2866754b5576e8181b118717a4781.exeC:\Users\Admin\AppData\Local\Temp\1bf2866754b5576e8181b118717a4781.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2384-13-0x00000000748F0000-0x00000000750A0000-memory.dmp
memory/2384-1-0x0000000000740000-0x00000000007A2000-memory.dmp
memory/2384-2-0x0000000005140000-0x00000000051B6000-memory.dmp
memory/2384-3-0x0000000005310000-0x0000000005320000-memory.dmp
memory/2384-4-0x00000000050C0000-0x00000000050DE000-memory.dmp
memory/2384-5-0x00000000058D0000-0x0000000005E74000-memory.dmp
memory/2384-6-0x00000000748F0000-0x00000000750A0000-memory.dmp
memory/2384-0-0x00000000748F0000-0x00000000750A0000-memory.dmp
memory/2596-10-0x0000000005470000-0x0000000005482000-memory.dmp
memory/2596-8-0x00000000748F0000-0x00000000750A0000-memory.dmp
memory/2596-9-0x0000000005A00000-0x0000000006018000-memory.dmp
memory/2596-12-0x00000000054D0000-0x000000000550C000-memory.dmp
memory/2596-7-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2596-14-0x0000000005550000-0x0000000005560000-memory.dmp
memory/2596-15-0x0000000005560000-0x00000000055AC000-memory.dmp
memory/2596-16-0x0000000005780000-0x000000000588A000-memory.dmp
memory/2596-17-0x00000000748F0000-0x00000000750A0000-memory.dmp
memory/2596-18-0x0000000005550000-0x0000000005560000-memory.dmp