Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 19:38

General

  • Target

    5755009e6a34f037e90a17ccd059cc44.exe

  • Size

    338KB

  • MD5

    5755009e6a34f037e90a17ccd059cc44

  • SHA1

    164bca1a97fd346352aeb645922fd9a3e8f7a1ab

  • SHA256

    f1ae795f186c015b05fd1572f41fb43b0cd267bf135d98a3e12d2dc8c7b90e3e

  • SHA512

    360e64220bc9316bdf087e1a1e5b1cb55e6e2713f78f029995c3ba72cee91b12d37bdcd8f5cc597bcecc5d24a0cd1238049cf23d67a1c520620bdab0d7d06cfe

  • SSDEEP

    6144:p/MJTKpzkWBJ9vmS0fiZEK80OG51pUV8kBmJEs96WdA3rRVNwX/iu:k+JkEzOSpZEx0Jf6pBmJEs9uw6u

Malware Config

Extracted

Family

redline

Botnet

test

C2

193.56.146.78:51487

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5755009e6a34f037e90a17ccd059cc44.exe
    "C:\Users\Admin\AppData\Local\Temp\5755009e6a34f037e90a17ccd059cc44.exe"
    1⤵
      PID:4728

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4728-1-0x00000000025F0000-0x00000000026F0000-memory.dmp

            Filesize

            1024KB

          • memory/4728-2-0x0000000002490000-0x00000000024C0000-memory.dmp

            Filesize

            192KB

          • memory/4728-3-0x0000000000400000-0x00000000023BF000-memory.dmp

            Filesize

            31.7MB

          • memory/4728-4-0x0000000074C30000-0x00000000753E0000-memory.dmp

            Filesize

            7.7MB

          • memory/4728-5-0x0000000000400000-0x00000000023BF000-memory.dmp

            Filesize

            31.7MB

          • memory/4728-6-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB

          • memory/4728-7-0x0000000004190000-0x00000000041B4000-memory.dmp

            Filesize

            144KB

          • memory/4728-8-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB

          • memory/4728-9-0x0000000006CC0000-0x0000000007264000-memory.dmp

            Filesize

            5.6MB

          • memory/4728-10-0x0000000004380000-0x00000000043A2000-memory.dmp

            Filesize

            136KB

          • memory/4728-11-0x00000000025F0000-0x00000000026F0000-memory.dmp

            Filesize

            1024KB

          • memory/4728-12-0x0000000007270000-0x0000000007888000-memory.dmp

            Filesize

            6.1MB

          • memory/4728-13-0x0000000004560000-0x0000000004572000-memory.dmp

            Filesize

            72KB

          • memory/4728-14-0x0000000006B80000-0x0000000006C8A000-memory.dmp

            Filesize

            1.0MB

          • memory/4728-15-0x0000000002490000-0x00000000024C0000-memory.dmp

            Filesize

            192KB

          • memory/4728-16-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB

          • memory/4728-17-0x0000000007890000-0x00000000078CC000-memory.dmp

            Filesize

            240KB

          • memory/4728-18-0x00000000078E0000-0x000000000792C000-memory.dmp

            Filesize

            304KB

          • memory/4728-20-0x0000000074C30000-0x00000000753E0000-memory.dmp

            Filesize

            7.7MB

          • memory/4728-22-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB

          • memory/4728-23-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB

          • memory/4728-24-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB

          • memory/4728-26-0x0000000006CB0000-0x0000000006CC0000-memory.dmp

            Filesize

            64KB