Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 03:05

General

  • Target

    57d0d960e4b7a4d91ba76ed63733f651.exe

  • Size

    594KB

  • MD5

    57d0d960e4b7a4d91ba76ed63733f651

  • SHA1

    4b2beaabb4db2d61b0e38be8fe7554a7cb07f273

  • SHA256

    4ef7c382cc0efa37b7d009d78ae2e4cb023be523ba22d5f4b90a858123ea1be0

  • SHA512

    b24e65205839111f7ba0aa1a58bb7b56c334961cbe3288fc36bcff92b96576e096c302cc8c1c9060a2c40c041c3b548af131126008437c28678758796e7de38e

  • SSDEEP

    12288:rU9zXTkRC7igcqkAWt4A457juR2u1BIZ1FlAMe15:rKXnFe5

Malware Config

Extracted

Family

redline

Botnet

EU3

C2

185.234.247.197:33071

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
    "C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
      C:\Users\Admin\AppData\Local\Temp\57d0d960e4b7a4d91ba76ed63733f651.exe
      2⤵
        PID:4976
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:1796
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2404

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\57d0d960e4b7a4d91ba76ed63733f651.exe.log

              Filesize

              700B

              MD5

              e5352797047ad2c91b83e933b24fbc4f

              SHA1

              9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

              SHA256

              b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

              SHA512

              dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

            • memory/2404-35-0x000001EED7970000-0x000001EED7980000-memory.dmp

              Filesize

              64KB

            • memory/2404-51-0x000001EEDFCE0000-0x000001EEDFCE1000-memory.dmp

              Filesize

              4KB

            • memory/2404-19-0x000001EED7870000-0x000001EED7880000-memory.dmp

              Filesize

              64KB

            • memory/2404-53-0x000001EEDFD10000-0x000001EEDFD11000-memory.dmp

              Filesize

              4KB

            • memory/2404-54-0x000001EEDFD10000-0x000001EEDFD11000-memory.dmp

              Filesize

              4KB

            • memory/2404-55-0x000001EEDFE20000-0x000001EEDFE21000-memory.dmp

              Filesize

              4KB

            • memory/2740-4-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

              Filesize

              120KB

            • memory/2740-9-0x00000000750D0000-0x0000000075880000-memory.dmp

              Filesize

              7.7MB

            • memory/2740-0-0x0000000000240000-0x00000000002DA000-memory.dmp

              Filesize

              616KB

            • memory/2740-5-0x00000000051F0000-0x0000000005794000-memory.dmp

              Filesize

              5.6MB

            • memory/2740-3-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

              Filesize

              64KB

            • memory/2740-2-0x0000000004B00000-0x0000000004B76000-memory.dmp

              Filesize

              472KB

            • memory/2740-1-0x00000000750D0000-0x0000000075880000-memory.dmp

              Filesize

              7.7MB

            • memory/4976-6-0x0000000000400000-0x0000000000420000-memory.dmp

              Filesize

              128KB

            • memory/4976-16-0x0000000004E30000-0x0000000004E7C000-memory.dmp

              Filesize

              304KB

            • memory/4976-17-0x00000000750D0000-0x0000000075880000-memory.dmp

              Filesize

              7.7MB

            • memory/4976-18-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

              Filesize

              64KB

            • memory/4976-13-0x0000000004E80000-0x0000000004F8A000-memory.dmp

              Filesize

              1.0MB

            • memory/4976-15-0x0000000004DF0000-0x0000000004E2C000-memory.dmp

              Filesize

              240KB

            • memory/4976-14-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

              Filesize

              64KB

            • memory/4976-12-0x0000000004D50000-0x0000000004D62000-memory.dmp

              Filesize

              72KB

            • memory/4976-11-0x00000000750D0000-0x0000000075880000-memory.dmp

              Filesize

              7.7MB

            • memory/4976-10-0x00000000052F0000-0x0000000005908000-memory.dmp

              Filesize

              6.1MB