Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 10:05
Static task
static1
Behavioral task
behavioral1
Sample
65f02521e4d3d357608eb923fa6930f5.exe
Resource
win7-20231215-en
General
-
Target
65f02521e4d3d357608eb923fa6930f5.exe
-
Size
378KB
-
MD5
65f02521e4d3d357608eb923fa6930f5
-
SHA1
bc8165197cb12767ac93bc49922d1c7c67e2eb6b
-
SHA256
e3fcc56bcfd2108829e5bbb481f260e31828c4a38d93bc1ac294b48cff7245cc
-
SHA512
ee933f281dcc69f1dcac7975627c289b443cf14e6feb4863f8397c19a37e11d2f51baba85be740d962cc8d31347e763e03e486460e78a74cea32ecc423d61243
-
SSDEEP
6144:R2whUfR1GfxfRT4ROvAK+VZtJTiKBsM4d0WOFUehGhwPgdFHoU1:NhsR1GfxfRT4YoK+VZtJTZBsM4d0WOFS
Malware Config
Extracted
redline
777
185.203.243.131:27365
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
65f02521e4d3d357608eb923fa6930f5.exedescription pid process target process PID 4164 set thread context of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
65f02521e4d3d357608eb923fa6930f5.exedescription pid process Token: SeDebugPrivilege 904 65f02521e4d3d357608eb923fa6930f5.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
65f02521e4d3d357608eb923fa6930f5.exedescription pid process target process PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 4164 wrote to memory of 904 4164 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exe"C:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exeC:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-14-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/904-10-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/904-12-0x00000000050B0000-0x00000000050C2000-memory.dmpFilesize
72KB
-
memory/904-18-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/904-17-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/904-16-0x0000000005400000-0x000000000550A000-memory.dmpFilesize
1.0MB
-
memory/904-6-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/904-11-0x0000000005620000-0x0000000005C38000-memory.dmpFilesize
6.1MB
-
memory/904-15-0x0000000005190000-0x00000000051DC000-memory.dmpFilesize
304KB
-
memory/904-13-0x0000000005150000-0x000000000518C000-memory.dmpFilesize
240KB
-
memory/4164-5-0x00000000054E0000-0x0000000005A84000-memory.dmpFilesize
5.6MB
-
memory/4164-3-0x0000000004EE0000-0x0000000004EF0000-memory.dmpFilesize
64KB
-
memory/4164-0-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/4164-2-0x0000000004DD0000-0x0000000004E46000-memory.dmpFilesize
472KB
-
memory/4164-1-0x0000000000420000-0x0000000000484000-memory.dmpFilesize
400KB
-
memory/4164-9-0x0000000074CC0000-0x0000000075470000-memory.dmpFilesize
7.7MB
-
memory/4164-4-0x0000000004DA0000-0x0000000004DBE000-memory.dmpFilesize
120KB