Analysis
-
max time kernel
131s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10-01-2024 03:25
General
-
Target
a56ab2abe69823efba8192aad89c0521b3869f091752ce63e7ec399f679b1768.exe
-
Size
95KB
-
MD5
bdd591abdd4acc492a22e106c01afc00
-
SHA1
cbb251313cafe324debde7bd9255afb0c668d128
-
SHA256
a56ab2abe69823efba8192aad89c0521b3869f091752ce63e7ec399f679b1768
-
SHA512
6174827d726abf8d59de7009e642b089cdfc6b450190665374663cb4253ba0a276e0c187eeec59b4bb0fd677c5121d701dcecdf5fdd8ae6f308370f9705e4e31
-
SSDEEP
1536:nqsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2v3teulgS6pQZQU1:VAMOY3+zi0ZbYe1g0ujyzdzQZQU1
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
cheat
C2
31.210.43.215:51414
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a56ab2abe69823efba8192aad89c0521b3869f091752ce63e7ec399f679b1768.exe"C:\Users\Admin\AppData\Local\Temp\a56ab2abe69823efba8192aad89c0521b3869f091752ce63e7ec399f679b1768.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB