Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
598c257c885f0b71816ff13d27b2579e.exe
Resource
win7-20231215-en
General
-
Target
598c257c885f0b71816ff13d27b2579e.exe
-
Size
1.2MB
-
MD5
598c257c885f0b71816ff13d27b2579e
-
SHA1
90acb05b8cb1ab4231b82b9bc569de250d64954b
-
SHA256
c08a9cfbdce610761ba0a3554c41665865249548074f5d3ae3dbad8513d41da2
-
SHA512
aff9fdf8f3de7c023c1f6a07051caad0748f71fa16826284bd2aa424c3a78ee98c75f414a532a5b91bab864ff2142475a8319e709ca29c6e1f52849b95ed3e49
-
SSDEEP
24576:8iHghAkJJEA5SYE2IEj/WKlhFI2+/gkb7PC5srrD9pT:hgm675SPG9FI/1dPz
Malware Config
Extracted
redline
ADS
135.125.215.49:54405
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/2988-7-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/2988-7-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1504 set thread context of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1504 598c257c885f0b71816ff13d27b2579e.exe Token: SeDebugPrivilege 2988 598c257c885f0b71816ff13d27b2579e.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1704 1504 598c257c885f0b71816ff13d27b2579e.exe 102 PID 1504 wrote to memory of 1704 1504 598c257c885f0b71816ff13d27b2579e.exe 102 PID 1504 wrote to memory of 1704 1504 598c257c885f0b71816ff13d27b2579e.exe 102 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103 PID 1504 wrote to memory of 2988 1504 598c257c885f0b71816ff13d27b2579e.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\598c257c885f0b71816ff13d27b2579e.exe"C:\Users\Admin\AppData\Local\Temp\598c257c885f0b71816ff13d27b2579e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\598c257c885f0b71816ff13d27b2579e.exeC:\Users\Admin\AppData\Local\Temp\598c257c885f0b71816ff13d27b2579e.exe2⤵PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\598c257c885f0b71816ff13d27b2579e.exeC:\Users\Admin\AppData\Local\Temp\598c257c885f0b71816ff13d27b2579e.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\598c257c885f0b71816ff13d27b2579e.exe.log
Filesize1KB
MD57691b76d082c036117114f9bec9e9142
SHA163a8ed6db4700c9379b2373778a5b256f3b46766
SHA256e74e3413956f70b36eac1225af454552017ac540bb5756ff571cc2eb6134c7ed
SHA5128a5da9db3c9c85161030a3094120b9e32db1e9587229742e9a2729cb564ec4633804a79e818f1c12276bd743aadd2c9596a44fec023c770032009afe2cf51f9c