Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09-01-2024 18:12
General
-
Target
eebe64044af61dc30328295994dc3196.exe
-
Size
337KB
-
MD5
eebe64044af61dc30328295994dc3196
-
SHA1
c5dc3c6ffda326b4ad7f7cb77893aa90ea22ba55
-
SHA256
0f1ec47370820485c7d46563ed77ec1bec66c4d79ddd2b68da796e16232846a3
-
SHA512
d855ac8432a6b465e346ee9112d5588f5a441daf21cbcdf6eccb8c1da406a5ef4a3b15f61c2839887cedbc490374ea712c220c543d40c03c005103b810220d0b
-
SSDEEP
6144:yPnSv25sX2jyM9o5mursZpXVwBPAnpQx5AH:6Svcs+oFsZNWBPAi
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
SewPalpadin
C2
185.215.113.114:8887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196.exe"C:\Users\Admin\AppData\Local\Temp\eebe64044af61dc30328295994dc3196.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2500-3-0x0000000000400000-0x00000000008BE000-memory.dmpFilesize
4.7MB
-
memory/2500-2-0x0000000000220000-0x000000000024F000-memory.dmpFilesize
188KB
-
memory/2500-6-0x00000000026D0000-0x0000000002710000-memory.dmpFilesize
256KB
-
memory/2500-7-0x00000000008C0000-0x00000000008DE000-memory.dmpFilesize
120KB
-
memory/2500-5-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2500-4-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/2500-1-0x0000000000960000-0x0000000000A60000-memory.dmpFilesize
1024KB
-
memory/2500-9-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2500-10-0x0000000000960000-0x0000000000A60000-memory.dmpFilesize
1024KB