Analysis

  • max time kernel
    179s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 14:13

General

  • Target

    248de0e5ec264bbcdc5d5cf89c88c9d5.exe

  • Size

    675KB

  • MD5

    248de0e5ec264bbcdc5d5cf89c88c9d5

  • SHA1

    e455c0a2b623cd9649bdecea0f2e496d72193574

  • SHA256

    2e484f46233635cb09729588419bf044a7766ac81c32321c717078c29a3cec9a

  • SHA512

    14f13eae97188b62e78b925d65119b0cf23597f48fca113afef05aa1eda1267be6be1903ee75d798993916040eddc5e515d18b82dbf33430f40f7e62921ca4e0

  • SSDEEP

    12288:nOsKHd7DCTXBYDzvYuvGrqIVWZJ4giqjdWwi8L1eypbWQOQ06yClIcjQNQ4mIxf9:zI/v8DVZwiCFMc5icEFmI5n05CuEjGMF

Malware Config

Extracted

Family

redline

C2

141.95.38.85:8879

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe
    "C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe
      C:\Users\Admin\AppData\Local\Temp\248de0e5ec264bbcdc5d5cf89c88c9d5.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3548

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3548-8-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/3548-25-0x0000000074440000-0x0000000074BF0000-memory.dmp

          Filesize

          7.7MB

        • memory/3548-29-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-27-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-28-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-26-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-7-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/3548-12-0x0000000003460000-0x0000000003482000-memory.dmp

          Filesize

          136KB

        • memory/3548-14-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-13-0x0000000074440000-0x0000000074BF0000-memory.dmp

          Filesize

          7.7MB

        • memory/3548-15-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-17-0x0000000003610000-0x0000000003630000-memory.dmp

          Filesize

          128KB

        • memory/3548-10-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/3548-16-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-23-0x0000000005D40000-0x0000000005E4A000-memory.dmp

          Filesize

          1.0MB

        • memory/3548-18-0x0000000006D00000-0x0000000007318000-memory.dmp

          Filesize

          6.1MB

        • memory/3548-6-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/3548-19-0x0000000005A30000-0x0000000005A42000-memory.dmp

          Filesize

          72KB

        • memory/3548-20-0x0000000005A90000-0x0000000005ACC000-memory.dmp

          Filesize

          240KB

        • memory/3548-21-0x0000000005B70000-0x0000000005B80000-memory.dmp

          Filesize

          64KB

        • memory/3548-22-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

          Filesize

          304KB

        • memory/5008-3-0x0000000002AE0000-0x0000000002AFE000-memory.dmp

          Filesize

          120KB

        • memory/5008-24-0x0000000074440000-0x0000000074BF0000-memory.dmp

          Filesize

          7.7MB

        • memory/5008-1-0x0000000000570000-0x000000000061E000-memory.dmp

          Filesize

          696KB

        • memory/5008-5-0x0000000005780000-0x0000000005D24000-memory.dmp

          Filesize

          5.6MB

        • memory/5008-0-0x0000000074440000-0x0000000074BF0000-memory.dmp

          Filesize

          7.7MB

        • memory/5008-4-0x00000000051C0000-0x00000000051D0000-memory.dmp

          Filesize

          64KB

        • memory/5008-2-0x0000000004FC0000-0x0000000005036000-memory.dmp

          Filesize

          472KB