Analysis

  • max time kernel
    160s
  • max time network
    188s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 14:13

General

  • Target

    248de0e5ec264bbcdc5d5cf89c88c9d5.exe

  • Size

    675KB

  • MD5

    248de0e5ec264bbcdc5d5cf89c88c9d5

  • SHA1

    e455c0a2b623cd9649bdecea0f2e496d72193574

  • SHA256

    2e484f46233635cb09729588419bf044a7766ac81c32321c717078c29a3cec9a

  • SHA512

    14f13eae97188b62e78b925d65119b0cf23597f48fca113afef05aa1eda1267be6be1903ee75d798993916040eddc5e515d18b82dbf33430f40f7e62921ca4e0

  • SSDEEP

    12288:nOsKHd7DCTXBYDzvYuvGrqIVWZJ4giqjdWwi8L1eypbWQOQ06yClIcjQNQ4mIxf9:zI/v8DVZwiCFMc5icEFmI5n05CuEjGMF

Malware Config

Extracted

Family

redline

C2

141.95.38.85:8879

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe
    "C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe
      C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2752

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2752-6-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-23-0x0000000074770000-0x0000000074E5E000-memory.dmp

          Filesize

          6.9MB

        • memory/2752-26-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-3-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-5-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-4-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-10-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2752-25-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-12-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-14-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-7-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2752-24-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-18-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-15-0x0000000000370000-0x0000000000392000-memory.dmp

          Filesize

          136KB

        • memory/2752-17-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-19-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-16-0x0000000074770000-0x0000000074E5E000-memory.dmp

          Filesize

          6.9MB

        • memory/2752-20-0x00000000003D0000-0x00000000003F0000-memory.dmp

          Filesize

          128KB

        • memory/2752-21-0x0000000000220000-0x0000000000260000-memory.dmp

          Filesize

          256KB

        • memory/2752-22-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/2780-0-0x0000000000BC0000-0x0000000000C6E000-memory.dmp

          Filesize

          696KB

        • memory/2780-1-0x00000000747C0000-0x0000000074EAE000-memory.dmp

          Filesize

          6.9MB

        • memory/2780-13-0x00000000747C0000-0x0000000074EAE000-memory.dmp

          Filesize

          6.9MB

        • memory/2780-2-0x0000000000B40000-0x0000000000B80000-memory.dmp

          Filesize

          256KB