Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 16:06

General

  • Target

    2bc1f2a0dada4b055ffd21affaedd90c.exe

  • Size

    376KB

  • MD5

    2bc1f2a0dada4b055ffd21affaedd90c

  • SHA1

    2065b033bfbf85e5de5cc933f8834c02220fe5a1

  • SHA256

    1735440f3b7cbcb8ac567ba7fbeb0ad5465184b2663681f59b11d4a1650fadda

  • SHA512

    516039b70ddb06f00f50aff3ad6a59a36d89a63831b336917d756da35a8bdaf297b7d5715115660e4e4ca5889cb82f58eff25d358e6608a51c6493a9bcfd7963

  • SSDEEP

    6144:oM4Ry81AxEauvBEAs5cOPQqJT13OIK7Caok+enI:oM4EEAxEauvBEAs5cOPQqJT13OIK7CaU

Malware Config

Extracted

Family

redline

Botnet

@TyBaby_LZT

C2

45.12.213.248:36372

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bc1f2a0dada4b055ffd21affaedd90c.exe
    "C:\Users\Admin\AppData\Local\Temp\2bc1f2a0dada4b055ffd21affaedd90c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\2bc1f2a0dada4b055ffd21affaedd90c.exe
      C:\Users\Admin\AppData\Local\Temp\2bc1f2a0dada4b055ffd21affaedd90c.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3136

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2bc1f2a0dada4b055ffd21affaedd90c.exe.log

          Filesize

          700B

          MD5

          e5352797047ad2c91b83e933b24fbc4f

          SHA1

          9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

          SHA256

          b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

          SHA512

          dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

        • memory/436-9-0x0000000074620000-0x0000000074DD0000-memory.dmp

          Filesize

          7.7MB

        • memory/436-1-0x0000000074620000-0x0000000074DD0000-memory.dmp

          Filesize

          7.7MB

        • memory/436-3-0x0000000005590000-0x00000000055AE000-memory.dmp

          Filesize

          120KB

        • memory/436-4-0x0000000005860000-0x0000000005870000-memory.dmp

          Filesize

          64KB

        • memory/436-5-0x0000000005E20000-0x00000000063C4000-memory.dmp

          Filesize

          5.6MB

        • memory/436-2-0x00000000055F0000-0x0000000005666000-memory.dmp

          Filesize

          472KB

        • memory/436-0-0x0000000000C00000-0x0000000000C64000-memory.dmp

          Filesize

          400KB

        • memory/3136-14-0x0000000005AD0000-0x0000000005B0C000-memory.dmp

          Filesize

          240KB

        • memory/3136-6-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/3136-11-0x0000000074620000-0x0000000074DD0000-memory.dmp

          Filesize

          7.7MB

        • memory/3136-13-0x0000000005A70000-0x0000000005A82000-memory.dmp

          Filesize

          72KB

        • memory/3136-12-0x0000000006A20000-0x0000000007038000-memory.dmp

          Filesize

          6.1MB

        • memory/3136-10-0x00000000059A0000-0x0000000005A32000-memory.dmp

          Filesize

          584KB

        • memory/3136-16-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

          Filesize

          304KB

        • memory/3136-15-0x0000000005BC0000-0x0000000005BD0000-memory.dmp

          Filesize

          64KB

        • memory/3136-17-0x00000000083B0000-0x00000000084BA000-memory.dmp

          Filesize

          1.0MB

        • memory/3136-18-0x0000000074620000-0x0000000074DD0000-memory.dmp

          Filesize

          7.7MB

        • memory/3136-19-0x0000000005BC0000-0x0000000005BD0000-memory.dmp

          Filesize

          64KB