Analysis
- max time kernel
146s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
26/12/2023, 14:12
General
- Target 74b6287a45b3fe5949ffa87f2019f1b2.exe
- Size 329KB
- Sample231226-rh3egadegr
- SHA256 fca68250f0af2ea4d2ae1747c92b89e67799cd41db4b6dfe8eed57cdcf1cb07b
Malware Config
Extracted
-
redline
-
170
-
147.124.222.75:42864
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b6287a45b3fe5949ffa87f2019f1b2.exe"C:\Users\Admin\AppData\Local\Temp\74b6287a45b3fe5949ffa87f2019f1b2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3588-1-0x0000000000770000-0x0000000000870000-memory.dmp
memory/3588-2-0x00000000006A0000-0x00000000006CF000-memory.dmp
memory/3588-3-0x0000000000400000-0x00000000004D6000-memory.dmp
memory/3588-5-0x0000000074ED0000-0x0000000075680000-memory.dmp
memory/3588-7-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3588-6-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3588-4-0x00000000024D0000-0x00000000024F0000-memory.dmp
memory/3588-8-0x0000000004D40000-0x00000000052E4000-memory.dmp
memory/3588-9-0x0000000004BB0000-0x0000000004BCE000-memory.dmp
memory/3588-10-0x00000000052F0000-0x0000000005908000-memory.dmp
memory/3588-11-0x0000000004C70000-0x0000000004C82000-memory.dmp
memory/3588-12-0x0000000004C90000-0x0000000004CCC000-memory.dmp
memory/3588-13-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3588-14-0x0000000005910000-0x000000000595C000-memory.dmp
memory/3588-15-0x0000000005A60000-0x0000000005B6A000-memory.dmp
memory/3588-16-0x0000000000400000-0x00000000004D6000-memory.dmp
memory/3588-17-0x0000000000770000-0x0000000000870000-memory.dmp
memory/3588-18-0x00000000006A0000-0x00000000006CF000-memory.dmp
memory/3588-19-0x0000000074ED0000-0x0000000075680000-memory.dmp
memory/3588-21-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/3588-22-0x0000000004D30000-0x0000000004D40000-memory.dmp