Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2024, 14:57

General

  • Target

    59011b30630b327f21b0c6c070e6bdc3.exe

  • Size

    100KB

  • MD5

    59011b30630b327f21b0c6c070e6bdc3

  • SHA1

    b66bb460126a2341c13b4bd8aa9c75062eddc0c2

  • SHA256

    b25de8622f43e2beb203e0e394906bd6832f95277f53c4dbd59d4afbcef7b361

  • SHA512

    3ee47b6351ead753f3edc1eadb41a6d6001c0dd0121b7d29c887b5d4139c49cdea2bacf5ad142abd63d3f893bb6c9968e1b25616f61f04fa92174ee699cfa655

  • SSDEEP

    1536:Wo6aGLKCzK2ZHMkDK2e9oZPFauhwPgbue7v5ujNyAsdgnetx5REPG6WAaoigm:WdxGCzh30uv35uxyddjNWlW

Malware Config

Extracted

Family

redline

Botnet

installs2

C2

65.21.228.92:46802

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59011b30630b327f21b0c6c070e6bdc3.exe
    "C:\Users\Admin\AppData\Local\Temp\59011b30630b327f21b0c6c070e6bdc3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2024-0-0x0000000000100000-0x000000000011E000-memory.dmp

          Filesize

          120KB

        • memory/2024-1-0x0000000074870000-0x0000000074F5E000-memory.dmp

          Filesize

          6.9MB

        • memory/2024-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB

        • memory/2024-3-0x0000000074870000-0x0000000074F5E000-memory.dmp

          Filesize

          6.9MB

        • memory/2024-4-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB