Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 17:55
Static task
static1
Behavioral task
behavioral1
Sample
571ec37bbc0a7b94c3a3829ee47e5bad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
571ec37bbc0a7b94c3a3829ee47e5bad.exe
Resource
win10v2004-20231215-en
General
-
Target
571ec37bbc0a7b94c3a3829ee47e5bad.exe
-
Size
216KB
-
MD5
571ec37bbc0a7b94c3a3829ee47e5bad
-
SHA1
ef44ce30e13c73e4b07e3067b1e2107fe8948d8b
-
SHA256
459a684a6e6299ffbd967855a504ff2311cba4a8eccae192b1f4146cc3bf7382
-
SHA512
6a9d95f3d47f1e2ef45db236efbb8bc265fdfb9979163c6e7d2f51fb204be4930fe06b1ba63047482b7c9f34d7cb72106178484fead7f332abea22d733aa84b6
-
SSDEEP
3072:ktHnC1FHiLW9Oxi8uFbNUaBAICgV04WEyF5uXa0ToO/wumRE6Q14vmOw38a9Mm:kkmLBxczCmJyTu3p9OQ1qoYm
Malware Config
Extracted
redline
Cryptex0816
185.92.73.140:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4824-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/4824-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1028 set thread context of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe Token: SeDebugPrivilege 4824 571ec37bbc0a7b94c3a3829ee47e5bad.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95 PID 1028 wrote to memory of 4824 1028 571ec37bbc0a7b94c3a3829ee47e5bad.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"C:\Users\Admin\AppData\Local\Temp\571ec37bbc0a7b94c3a3829ee47e5bad.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\571ec37bbc0a7b94c3a3829ee47e5bad.exe.log
Filesize617B
MD5f5a69d9216974a1b017e4e94be20c63f
SHA16993175a82e6ffa484b2bfbf691668f11484ef17
SHA256471ce598bfe72b7166f3e1b669c84436e2d6cb758dd98e8d0e4cb44a230f42ee
SHA512d9164f8573c6cabd01357e8f27e1500100ae932aed51f6a08734dc739e36c61e2e8b231f6ce3aaac2d9b279c3ade0ad7c5189925ee7d75d4820acfdd2cac11fd