Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06/01/2024, 06:52
General
-
Target
45917de21a6088ed41b735f04b8c441c.exe
-
Size
398KB
-
MD5
45917de21a6088ed41b735f04b8c441c
-
SHA1
7fcf57469babfbf6c99a611b0ed47eef7c4f6b6e
-
SHA256
3ef227459f5ea632eedaba68d9d410521e75e24c41a0de0cdf26084761fd6129
-
SHA512
9d1e5c4fbdb0ad07aa14d778c57a8ebefba98c86426845b140412343659f1861bffe0753fc074d6abc1e9d80fc2c2d3d0aae6b830686f82d6d840e1cc92dfa88
-
SSDEEP
12288:C359mzJvK0g1qTXHWvLSaS8ogvgiu0Hd6:1NvK0gvLS1cgid96
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
170
C2
147.124.222.75:42864
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45917de21a6088ed41b735f04b8c441c.exe"C:\Users\Admin\AppData\Local\Temp\45917de21a6088ed41b735f04b8c441c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
188KB
-
Filesize
508KB
-
Filesize
128KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
120KB
-
Filesize
508KB
-
Filesize
1024KB
-
Filesize
188KB
-
Filesize
6.9MB
-
Filesize
256KB