Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 12:40

General

  • Target

    1f1e8ec42168ab9b166714b8d78d1bf9.exe

  • Size

    382KB

  • MD5

    1f1e8ec42168ab9b166714b8d78d1bf9

  • SHA1

    dca4a68c8835b2d943fda651684bc7084e9e8889

  • SHA256

    a563f1fae3c7c4097a686978866f01a4af153ed082260ebd87ccb19416036e39

  • SHA512

    e9e703923259fd5c29133de787e7abed8b13107351b57ad429158fbbf0bee363822e042395a58590d6d57aef6acf3ce8f4ff0e866fbbb78ac357b2bdaaec710f

  • SSDEEP

    6144:+JeDoPZM5LnzbK9jTiUs1EeG4+LccIhpw2yVWez/n1y5etYhpQ6edFofVnPUNI:0csYDqjnwvQ6eGV

Malware Config

Extracted

Family

redline

Botnet

@tsiw13

C2

185.80.234.77:17105

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe
    "C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe
      "{path}"
      2⤵
        PID:4120
      • C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe
        "{path}"
        2⤵
          PID:4840
        • C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe
          "{path}"
          2⤵
            PID:1036
          • C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe
            "{path}"
            2⤵
              PID:1424
            • C:\Users\Admin\AppData\Local\Temp\1f1e8ec42168ab9b166714b8d78d1bf9.exe
              "{path}"
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2968

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1f1e8ec42168ab9b166714b8d78d1bf9.exe.log

                  Filesize

                  1KB

                  MD5

                  8ec831f3e3a3f77e4a7b9cd32b48384c

                  SHA1

                  d83f09fd87c5bd86e045873c231c14836e76a05c

                  SHA256

                  7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                  SHA512

                  26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                • memory/2968-19-0x0000000006720000-0x000000000675C000-memory.dmp

                  Filesize

                  240KB

                • memory/2968-16-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2968-24-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

                  Filesize

                  64KB

                • memory/2968-23-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2968-22-0x0000000008340000-0x000000000844A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/2968-20-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

                  Filesize

                  64KB

                • memory/2968-21-0x0000000006860000-0x00000000068AC000-memory.dmp

                  Filesize

                  304KB

                • memory/2968-18-0x0000000005960000-0x0000000005972000-memory.dmp

                  Filesize

                  72KB

                • memory/2968-12-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                • memory/2968-17-0x00000000069B0000-0x0000000006FC8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/4408-7-0x0000000007860000-0x00000000078FC000-memory.dmp

                  Filesize

                  624KB

                • memory/4408-9-0x0000000004F60000-0x0000000004F70000-memory.dmp

                  Filesize

                  64KB

                • memory/4408-8-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4408-14-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4408-2-0x00000000052B0000-0x0000000005854000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4408-10-0x0000000006090000-0x0000000006100000-memory.dmp

                  Filesize

                  448KB

                • memory/4408-1-0x0000000074CF0000-0x00000000754A0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4408-0-0x00000000004B0000-0x0000000000516000-memory.dmp

                  Filesize

                  408KB

                • memory/4408-11-0x0000000005F70000-0x0000000005F92000-memory.dmp

                  Filesize

                  136KB

                • memory/4408-6-0x0000000007700000-0x0000000007708000-memory.dmp

                  Filesize

                  32KB

                • memory/4408-5-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

                  Filesize

                  40KB

                • memory/4408-4-0x0000000004F60000-0x0000000004F70000-memory.dmp

                  Filesize

                  64KB

                • memory/4408-3-0x0000000004DE0000-0x0000000004E72000-memory.dmp

                  Filesize

                  584KB