Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/01/2024, 14:57
General
- Target 59011b30630b327f21b0c6c070e6bdc3.exe
- Size 100KB
- Sample240113-sbtpesbbfr
- SHA256 b25de8622f43e2beb203e0e394906bd6832f95277f53c4dbd59d4afbcef7b361
Malware Config
Extracted
-
redline
-
installs2
-
65.21.228.92:46802
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59011b30630b327f21b0c6c070e6bdc3.exe"C:\Users\Admin\AppData\Local\Temp\59011b30630b327f21b0c6c070e6bdc3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2668-0-0x0000000075180000-0x0000000075930000-memory.dmp
memory/2668-1-0x0000000000FB0000-0x0000000000FCE000-memory.dmp
memory/2668-2-0x0000000005EE0000-0x00000000064F8000-memory.dmp
memory/2668-3-0x0000000005970000-0x0000000005982000-memory.dmp
memory/2668-4-0x00000000059D0000-0x0000000005A0C000-memory.dmp
memory/2668-5-0x0000000005BB0000-0x0000000005BC0000-memory.dmp
memory/2668-6-0x0000000005A10000-0x0000000005A5C000-memory.dmp
memory/2668-7-0x0000000005CD0000-0x0000000005DDA000-memory.dmp
memory/2668-8-0x0000000075180000-0x0000000075930000-memory.dmp
memory/2668-9-0x0000000005BB0000-0x0000000005BC0000-memory.dmp