redline | c14d115b8521d8eff7d58acd565a4150b1eed68f112c2cd0b4e035326f831d73

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52a74ace007acd62f2984ca7e27056ba.exe
Size

343KB
MD5

52a74ace007acd62f2984ca7e27056ba
SHA1

00cdd8ed9f30384e955b597a5174236553be34d1
SHA256

c14d115b8521d8eff7d58acd565a4150b1eed68f112c2cd0b4e035326f831d73
SHA512

a92e76367acd21f9a9f29d2ef7ad435686b2bc43a25b46e90e0d5c3ccc0494c14b499a48150cb6b83ee8718eab19f271e38505326e9d745cb3c402fbd1b5f4cf
SSDEEP

6144:bXWy3bHJbcSZfMomMN3b6ng/BOu9vs2W7x5Sp2B9+qizkO+:Ckbp4SZpmMN3bTZdG5g2B9pWU

Score

10^/10

redline sectoprat build1 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

build1

91.142.77.189:59638

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2420-3-0x0000000003D20000-0x0000000003D44000-memory.dmp	family_redline
behavioral1/memory/2420-7-0x00000000041F0000-0x0000000004212000-memory.dmp	family_redline
behavioral1/memory/2420-9-0x0000000004240000-0x0000000004280000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2420-3-0x0000000003D20000-0x0000000003D44000-memory.dmp	family_sectoprat
behavioral1/memory/2420-7-0x00000000041F0000-0x0000000004212000-memory.dmp	family_sectoprat
behavioral1/memory/2420-9-0x0000000004240000-0x0000000004280000-memory.dmp	family_sectoprat
behavioral1/memory/2420-10-0x000000007EF40000-0x000000007EF50000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\52a74ace007acd62f2984ca7e27056ba.exe
"C:\Users\Admin\AppData\Local\Temp\52a74ace007acd62f2984ca7e27056ba.exe"
1⤵
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-1-0x0000000002820000-0x0000000002920000-memory.dmp

Filesize
1024KB

Download
memory/2420-2-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2420-4-0x0000000000400000-0x00000000023BD000-memory.dmp

Filesize
31.7MB

Download
memory/2420-3-0x0000000003D20000-0x0000000003D44000-memory.dmp

Filesize
144KB

Download
memory/2420-5-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2420-6-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2420-7-0x00000000041F0000-0x0000000004212000-memory.dmp

Filesize
136KB

Download
memory/2420-8-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-9-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2420-10-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/2420-12-0x0000000002820000-0x0000000002920000-memory.dmp

Filesize
1024KB

Download
memory/2420-13-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/2420-16-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2420-15-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2420-17-0x00000000741E0000-0x00000000748CE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-18-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2420-19-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download