Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 16:30

General

  • Target

    56f43b7aadd2ecb4dd9e5b29e155879c.exe

  • Size

    1.4MB

  • MD5

    56f43b7aadd2ecb4dd9e5b29e155879c

  • SHA1

    dbb31825f23738a271a8c15743aa6db8cca47665

  • SHA256

    503adcbbdd31b1398aa676a524163a5f4fc342b2722da40c20a422fcd926d345

  • SHA512

    0210a7f1917e541ff5d48f277810532f0515e376d291b8f1e0848eff740b8a770e965333d005b9646c794edceb6154b0bd5c1f6618522b238ec621af4e53e3e8

  • SSDEEP

    24576:e00F8WjlFjzkp7D8056p+R2SDrT3RRimyrRWBGFGI0EqduKU0Y6xtxrukomfk6P0:exF8WjlFjzkp7D8051533r4GGgIFqduN

Malware Config

Extracted

Family

redline

Botnet

Fonti

C2

87.251.71.78:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56f43b7aadd2ecb4dd9e5b29e155879c.exe
    "C:\Users\Admin\AppData\Local\Temp\56f43b7aadd2ecb4dd9e5b29e155879c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1624

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/384-12-0x0000000000F60000-0x0000000000FCA000-memory.dmp

          Filesize

          424KB

        • memory/384-7-0x0000000005230000-0x0000000005286000-memory.dmp

          Filesize

          344KB

        • memory/384-2-0x00000000050F0000-0x000000000518C000-memory.dmp

          Filesize

          624KB

        • memory/384-3-0x0000000005870000-0x0000000005E14000-memory.dmp

          Filesize

          5.6MB

        • memory/384-4-0x00000000052C0000-0x0000000005352000-memory.dmp

          Filesize

          584KB

        • memory/384-5-0x00000000052B0000-0x00000000052C0000-memory.dmp

          Filesize

          64KB

        • memory/384-6-0x0000000005190000-0x000000000519A000-memory.dmp

          Filesize

          40KB

        • memory/384-16-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/384-8-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/384-9-0x00000000029A0000-0x00000000029D6000-memory.dmp

          Filesize

          216KB

        • memory/384-10-0x00000000052B0000-0x00000000052C0000-memory.dmp

          Filesize

          64KB

        • memory/384-11-0x0000000000D40000-0x0000000000DAE000-memory.dmp

          Filesize

          440KB

        • memory/384-0-0x00000000005A0000-0x0000000000710000-memory.dmp

          Filesize

          1.4MB

        • memory/384-13-0x0000000000FD0000-0x0000000000FF4000-memory.dmp

          Filesize

          144KB

        • memory/384-1-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1624-22-0x0000000004E90000-0x0000000004EDC000-memory.dmp

          Filesize

          304KB

        • memory/1624-17-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1624-19-0x0000000004DF0000-0x0000000004E02000-memory.dmp

          Filesize

          72KB

        • memory/1624-18-0x00000000053A0000-0x00000000059B8000-memory.dmp

          Filesize

          6.1MB

        • memory/1624-20-0x0000000004E50000-0x0000000004E8C000-memory.dmp

          Filesize

          240KB

        • memory/1624-21-0x0000000005020000-0x0000000005030000-memory.dmp

          Filesize

          64KB

        • memory/1624-14-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/1624-23-0x0000000005140000-0x000000000524A000-memory.dmp

          Filesize

          1.0MB

        • memory/1624-24-0x0000000075390000-0x0000000075B40000-memory.dmp

          Filesize

          7.7MB

        • memory/1624-25-0x0000000005020000-0x0000000005030000-memory.dmp

          Filesize

          64KB