Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 17:55
Static task
static1
Behavioral task
behavioral1
Sample
571ec37bbc0a7b94c3a3829ee47e5bad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
571ec37bbc0a7b94c3a3829ee47e5bad.exe
Resource
win10v2004-20231215-en
General
-
Target
571ec37bbc0a7b94c3a3829ee47e5bad.exe
-
Size
216KB
-
MD5
571ec37bbc0a7b94c3a3829ee47e5bad
-
SHA1
ef44ce30e13c73e4b07e3067b1e2107fe8948d8b
-
SHA256
459a684a6e6299ffbd967855a504ff2311cba4a8eccae192b1f4146cc3bf7382
-
SHA512
6a9d95f3d47f1e2ef45db236efbb8bc265fdfb9979163c6e7d2f51fb204be4930fe06b1ba63047482b7c9f34d7cb72106178484fead7f332abea22d733aa84b6
-
SSDEEP
3072:ktHnC1FHiLW9Oxi8uFbNUaBAICgV04WEyF5uXa0ToO/wumRE6Q14vmOw38a9Mm:kkmLBxczCmJyTu3p9OQ1qoYm
Malware Config
Extracted
redline
Cryptex0816
185.92.73.140:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral1/memory/1456-8-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1456-10-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1456-14-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1456-17-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1456-19-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1456-21-0x0000000004340000-0x0000000004380000-memory.dmp family_redline -
SectopRAT payload 7 IoCs
resource yara_rule behavioral1/memory/1456-8-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1456-10-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1456-14-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1456-17-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1456-19-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1456-21-0x0000000004340000-0x0000000004380000-memory.dmp family_sectoprat behavioral1/memory/1456-23-0x0000000004340000-0x0000000004380000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2088 set thread context of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe Token: SeDebugPrivilege 1456 571ec37bbc0a7b94c3a3829ee47e5bad.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29 PID 2088 wrote to memory of 1456 2088 571ec37bbc0a7b94c3a3829ee47e5bad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456
-