Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2024, 03:05

General

  • Target

    57d0d960e4b7a4d91ba76ed63733f651.exe

  • Size

    594KB

  • MD5

    57d0d960e4b7a4d91ba76ed63733f651

  • SHA1

    4b2beaabb4db2d61b0e38be8fe7554a7cb07f273

  • SHA256

    4ef7c382cc0efa37b7d009d78ae2e4cb023be523ba22d5f4b90a858123ea1be0

  • SHA512

    b24e65205839111f7ba0aa1a58bb7b56c334961cbe3288fc36bcff92b96576e096c302cc8c1c9060a2c40c041c3b548af131126008437c28678758796e7de38e

  • SSDEEP

    12288:rU9zXTkRC7igcqkAWt4A457juR2u1BIZ1FlAMe15:rKXnFe5

Malware Config

Extracted

Family

redline

Botnet

EU3

C2

185.234.247.197:33071

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
    "C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
      C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
      2⤵
        PID:2220
      • C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
        C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
        2⤵
          PID:2084

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2084-9-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2084-12-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2084-18-0x0000000000640000-0x0000000000680000-memory.dmp

              Filesize

              256KB

            • memory/2084-3-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2084-4-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2084-5-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2084-17-0x00000000744F0000-0x0000000074BDE000-memory.dmp

              Filesize

              6.9MB

            • memory/2084-16-0x0000000000640000-0x0000000000680000-memory.dmp

              Filesize

              256KB

            • memory/2084-15-0x00000000744F0000-0x0000000074BDE000-memory.dmp

              Filesize

              6.9MB

            • memory/2084-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2084-6-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2084-14-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/2164-0-0x0000000000830000-0x00000000008CA000-memory.dmp

              Filesize

              616KB

            • memory/2164-11-0x0000000074570000-0x0000000074C5E000-memory.dmp

              Filesize

              6.9MB

            • memory/2164-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

              Filesize

              6.9MB

            • memory/2164-2-0x0000000004A20000-0x0000000004A60000-memory.dmp

              Filesize

              256KB