Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-12-2023 03:53

General

  • Target

    c1a656d313538356cb86db92c0ce5ddf.exe

  • Size

    337KB

  • MD5

    c1a656d313538356cb86db92c0ce5ddf

  • SHA1

    76b8751bca5e79c8eee24d45e2cf6e0722265642

  • SHA256

    0b47db74abe595407c186f64d9a51895147468d4007d39aa7e2b98c165544dda

  • SHA512

    dc14b2f7dbeae4a0af8af40e14e09bab224459913a539a2f8e7604d4ee650a581d5b306f875ecab97563338bda0aab25ede77947854b4dbcf89293b2406f85d4

  • SSDEEP

    6144:1qnLDe76OGLGyCzQB4rMwHjEuzjSiBPAnpQx5AH:1qnnW6OGLvBKMwHjES/BPAi

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

185.215.113.114:8887

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1a656d313538356cb86db92c0ce5ddf.exe
    "C:\Users\Admin\AppData\Local\Temp\c1a656d313538356cb86db92c0ce5ddf.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2860-1-0x0000000000AB0000-0x0000000000BB0000-memory.dmp
    Filesize

    1024KB

  • memory/2860-2-0x0000000000A60000-0x0000000000A8F000-memory.dmp
    Filesize

    188KB

  • memory/2860-3-0x0000000000400000-0x00000000008BE000-memory.dmp
    Filesize

    4.7MB

  • memory/2860-6-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/2860-8-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/2860-10-0x0000000002A30000-0x0000000002A4E000-memory.dmp
    Filesize

    120KB

  • memory/2860-9-0x0000000005170000-0x0000000005714000-memory.dmp
    Filesize

    5.6MB

  • memory/2860-12-0x0000000002C00000-0x0000000002C12000-memory.dmp
    Filesize

    72KB

  • memory/2860-13-0x0000000002D40000-0x0000000002D7C000-memory.dmp
    Filesize

    240KB

  • memory/2860-11-0x0000000005720000-0x0000000005D38000-memory.dmp
    Filesize

    6.1MB

  • memory/2860-7-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/2860-15-0x0000000002D90000-0x0000000002DDC000-memory.dmp
    Filesize

    304KB

  • memory/2860-14-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/2860-5-0x0000000074630000-0x0000000074DE0000-memory.dmp
    Filesize

    7.7MB

  • memory/2860-4-0x0000000002880000-0x00000000028A0000-memory.dmp
    Filesize

    128KB

  • memory/2860-16-0x0000000005E40000-0x0000000005F4A000-memory.dmp
    Filesize

    1.0MB

  • memory/2860-18-0x0000000000AB0000-0x0000000000BB0000-memory.dmp
    Filesize

    1024KB

  • memory/2860-17-0x0000000000400000-0x00000000008BE000-memory.dmp
    Filesize

    4.7MB

  • memory/2860-19-0x0000000000A60000-0x0000000000A8F000-memory.dmp
    Filesize

    188KB

  • memory/2860-20-0x0000000074630000-0x0000000074DE0000-memory.dmp
    Filesize

    7.7MB

  • memory/2860-21-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB

  • memory/2860-23-0x00000000029B0000-0x00000000029C0000-memory.dmp
    Filesize

    64KB