Analysis

  • max time kernel
    153s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 17:55

General

  • Target

    571ec37bbc0a7b94c3a3829ee47e5bad.exe

  • Size

    216KB

  • MD5

    571ec37bbc0a7b94c3a3829ee47e5bad

  • SHA1

    ef44ce30e13c73e4b07e3067b1e2107fe8948d8b

  • SHA256

    459a684a6e6299ffbd967855a504ff2311cba4a8eccae192b1f4146cc3bf7382

  • SHA512

    6a9d95f3d47f1e2ef45db236efbb8bc265fdfb9979163c6e7d2f51fb204be4930fe06b1ba63047482b7c9f34d7cb72106178484fead7f332abea22d733aa84b6

  • SSDEEP

    3072:ktHnC1FHiLW9Oxi8uFbNUaBAICgV04WEyF5uXa0ToO/wumRE6Q14vmOw38a9Mm:kkmLBxczCmJyTu3p9OQ1qoYm

Malware Config

Extracted

Family

redline

Botnet

Cryptex0816

C2

185.92.73.140:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe
    "C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe
      "C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4824

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\571ec37bbc0a7b94c3a3829ee47e5bad.exe.log

          Filesize

          617B

          MD5

          f5a69d9216974a1b017e4e94be20c63f

          SHA1

          6993175a82e6ffa484b2bfbf691668f11484ef17

          SHA256

          471ce598bfe72b7166f3e1b669c84436e2d6cb758dd98e8d0e4cb44a230f42ee

          SHA512

          d9164f8573c6cabd01357e8f27e1500100ae932aed51f6a08734dc739e36c61e2e8b231f6ce3aaac2d9b279c3ade0ad7c5189925ee7d75d4820acfdd2cac11fd

        • memory/1028-0-0x0000000074550000-0x0000000074D00000-memory.dmp

          Filesize

          7.7MB

        • memory/1028-1-0x0000000000A40000-0x0000000000A66000-memory.dmp

          Filesize

          152KB

        • memory/1028-2-0x0000000005920000-0x0000000005EC4000-memory.dmp

          Filesize

          5.6MB

        • memory/1028-3-0x0000000005450000-0x00000000054EC000-memory.dmp

          Filesize

          624KB

        • memory/1028-4-0x00000000053B0000-0x00000000053D4000-memory.dmp

          Filesize

          144KB

        • memory/1028-5-0x0000000005420000-0x0000000005430000-memory.dmp

          Filesize

          64KB

        • memory/1028-9-0x0000000074550000-0x0000000074D00000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-10-0x0000000074550000-0x0000000074D00000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-6-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/4824-11-0x00000000057F0000-0x0000000005E08000-memory.dmp

          Filesize

          6.1MB

        • memory/4824-12-0x0000000005290000-0x00000000052A2000-memory.dmp

          Filesize

          72KB

        • memory/4824-13-0x00000000052F0000-0x000000000532C000-memory.dmp

          Filesize

          240KB

        • memory/4824-14-0x00000000054F0000-0x0000000005500000-memory.dmp

          Filesize

          64KB

        • memory/4824-15-0x0000000005330000-0x000000000537C000-memory.dmp

          Filesize

          304KB

        • memory/4824-16-0x0000000005610000-0x000000000571A000-memory.dmp

          Filesize

          1.0MB

        • memory/4824-17-0x0000000074550000-0x0000000074D00000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-18-0x00000000054F0000-0x0000000005500000-memory.dmp

          Filesize

          64KB