Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
28-12-2023 18:28
General
-
Target
eebe64044af61dc30328295994dc3196.exe
-
Size
337KB
-
MD5
eebe64044af61dc30328295994dc3196
-
SHA1
c5dc3c6ffda326b4ad7f7cb77893aa90ea22ba55
-
SHA256
0f1ec47370820485c7d46563ed77ec1bec66c4d79ddd2b68da796e16232846a3
-
SHA512
d855ac8432a6b465e346ee9112d5588f5a441daf21cbcdf6eccb8c1da406a5ef4a3b15f61c2839887cedbc490374ea712c220c543d40c03c005103b810220d0b
-
SSDEEP
6144:yPnSv25sX2jyM9o5mursZpXVwBPAnpQx5AH:6Svcs+oFsZNWBPAi
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
SewPalpadin
C2
185.215.113.114:8887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196.exe"C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2364-3-0x0000000000400000-0x00000000008BE000-memory.dmpFilesize
4.7MB
-
memory/2364-2-0x00000000003B0000-0x00000000003DF000-memory.dmpFilesize
188KB
-
memory/2364-6-0x0000000004F90000-0x0000000004FD0000-memory.dmpFilesize
256KB
-
memory/2364-7-0x0000000000CD0000-0x0000000000CEE000-memory.dmpFilesize
120KB
-
memory/2364-5-0x0000000074300000-0x00000000749EE000-memory.dmpFilesize
6.9MB
-
memory/2364-4-0x0000000000B50000-0x0000000000B70000-memory.dmpFilesize
128KB
-
memory/2364-1-0x0000000000D00000-0x0000000000E00000-memory.dmpFilesize
1024KB
-
memory/2364-10-0x0000000074300000-0x00000000749EE000-memory.dmpFilesize
6.9MB
-
memory/2364-9-0x0000000000D00000-0x0000000000E00000-memory.dmpFilesize
1024KB