Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 19:38

General

  • Target

    5755009e6a34f037e90a17ccd059cc44.exe

  • Size

    338KB

  • MD5

    5755009e6a34f037e90a17ccd059cc44

  • SHA1

    164bca1a97fd346352aeb645922fd9a3e8f7a1ab

  • SHA256

    f1ae795f186c015b05fd1572f41fb43b0cd267bf135d98a3e12d2dc8c7b90e3e

  • SHA512

    360e64220bc9316bdf087e1a1e5b1cb55e6e2713f78f029995c3ba72cee91b12d37bdcd8f5cc597bcecc5d24a0cd1238049cf23d67a1c520620bdab0d7d06cfe

  • SSDEEP

    6144:p/MJTKpzkWBJ9vmS0fiZEK80OG51pUV8kBmJEs96WdA3rRVNwX/iu:k+JkEzOSpZEx0Jf6pBmJEs9uw6u

Malware Config

Extracted

Family

redline

Botnet

test

C2

193.56.146.78:51487

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5755009e6a34f037e90a17ccd059cc44.exe
    "C:\Users\Admin\AppData\Local\Temp\5755009e6a34f037e90a17ccd059cc44.exe"
    1⤵
      PID:1980

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1980-1-0x0000000002520000-0x0000000002620000-memory.dmp

            Filesize

            1024KB

          • memory/1980-2-0x0000000000220000-0x0000000000250000-memory.dmp

            Filesize

            192KB

          • memory/1980-3-0x0000000000400000-0x00000000023BF000-memory.dmp

            Filesize

            31.7MB

          • memory/1980-4-0x00000000024D0000-0x00000000024F4000-memory.dmp

            Filesize

            144KB

          • memory/1980-5-0x0000000074D40000-0x000000007542E000-memory.dmp

            Filesize

            6.9MB

          • memory/1980-7-0x0000000006700000-0x0000000006740000-memory.dmp

            Filesize

            256KB

          • memory/1980-6-0x0000000006700000-0x0000000006740000-memory.dmp

            Filesize

            256KB

          • memory/1980-8-0x00000000024F0000-0x0000000002512000-memory.dmp

            Filesize

            136KB

          • memory/1980-9-0x0000000006700000-0x0000000006740000-memory.dmp

            Filesize

            256KB

          • memory/1980-11-0x0000000000220000-0x0000000000250000-memory.dmp

            Filesize

            192KB

          • memory/1980-12-0x0000000002520000-0x0000000002620000-memory.dmp

            Filesize

            1024KB

          • memory/1980-13-0x0000000074D40000-0x000000007542E000-memory.dmp

            Filesize

            6.9MB