Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-12-2023 12:22
General
-
Target
de5db6c4f43175526bc82bab48124b2e.exe
-
Size
410KB
-
MD5
de5db6c4f43175526bc82bab48124b2e
-
SHA1
4a6abb2ba5478d9b29a49e36518c585aec8e87fd
-
SHA256
93e2455a56c74a3f37f69fd8c918922fd5f32d1055f874f626bff8dc9203754e
-
SHA512
b406983819f86e7cbc5f03cd9a964a30292750e58b6bc22a8e2a3751d0af88ba40ac7788bcabfabc2d885721d07aa6a9b00801c41dae920a4c00dbbb020ee938
-
SSDEEP
12288:1iJo1KLSpH3orMbwTBzGZUxQBj9s8PqVze+O8Dt:X1K4orMbwTBzGZUxQBj9sT9
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
SewPalpadin
C2
185.215.113.114:8887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de5db6c4f43175526bc82bab48124b2e.exe"C:\Users\Admin\AppData\Local\Temp\de5db6c4f43175526bc82bab48124b2e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2256-2-0x0000000000220000-0x000000000024F000-memory.dmpFilesize
188KB
-
memory/2256-1-0x0000000003440000-0x0000000003540000-memory.dmpFilesize
1024KB
-
memory/2256-3-0x0000000000360000-0x0000000000380000-memory.dmpFilesize
128KB
-
memory/2256-6-0x0000000007790000-0x00000000077D0000-memory.dmpFilesize
256KB
-
memory/2256-5-0x0000000000400000-0x0000000003261000-memory.dmpFilesize
46.4MB
-
memory/2256-7-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/2256-4-0x0000000004C20000-0x0000000004C3E000-memory.dmpFilesize
120KB
-
memory/2256-9-0x0000000003440000-0x0000000003540000-memory.dmpFilesize
1024KB
-
memory/2256-11-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB