Analysis
- max time kernel
151s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
11/01/2024, 05:42
General
- Target 52b00196ec4be03ead1f289e52ea4ea1.exe
- Size 324KB
- Sample240111-gd8etafedp
- SHA256 6744ae6091d2af22f322ee5909226d3bdbd3befaaa165a596b65cdddc39eb5e8
Malware Config
Extracted
-
redline
-
@Braibf
-
dylarache.site:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52b00196ec4be03ead1f289e52ea4ea1.exe"C:\Users\Admin\AppData\Local\Temp\52b00196ec4be03ead1f289e52ea4ea1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1508-0-0x0000000075110000-0x00000000758C0000-memory.dmp
memory/1508-1-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/1508-2-0x00000000021F0000-0x0000000002230000-memory.dmp
memory/1508-3-0x0000000004BF0000-0x0000000005194000-memory.dmp
memory/1508-4-0x0000000004B40000-0x0000000004B7C000-memory.dmp
memory/1508-5-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/1508-6-0x0000000005870000-0x0000000005E88000-memory.dmp
memory/1508-7-0x0000000005F10000-0x0000000005FA2000-memory.dmp
memory/1508-8-0x0000000005FC0000-0x0000000005FD2000-memory.dmp
memory/1508-9-0x0000000006380000-0x00000000063BC000-memory.dmp
memory/1508-10-0x00000000056E0000-0x000000000572C000-memory.dmp
memory/1508-11-0x0000000006050000-0x000000000615A000-memory.dmp
memory/1508-12-0x0000000075110000-0x00000000758C0000-memory.dmp
memory/1508-13-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/1508-14-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/1508-15-0x0000000004BE0000-0x0000000004BF0000-memory.dmp