Analysis
- max time kernel
147s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
14/01/2024, 04:11
General
- Target 5a3eb93564a49e7b6a645d74ee19ef58.exe
- Size 263KB
- Sample240114-esd4eabghr
- SHA256 13c723d1548b43f711358b1dca9115c3bdd7932727e9927317d03dc5b5e925f2
Malware Config
Extracted
-
redline
-
185.215.113.29:8889
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a3eb93564a49e7b6a645d74ee19ef58.exe"C:\Users\Admin\AppData\Local\Temp\5a3eb93564a49e7b6a645d74ee19ef58.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2576-1-0x0000000002F00000-0x0000000003000000-memory.dmp
memory/2576-2-0x00000000048E0000-0x000000000490F000-memory.dmp
memory/2576-3-0x0000000004C00000-0x0000000004C22000-memory.dmp
memory/2576-4-0x0000000007420000-0x00000000079C4000-memory.dmp
memory/2576-7-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/2576-9-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/2576-10-0x00000000079D0000-0x0000000007FE8000-memory.dmp
memory/2576-12-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2576-13-0x0000000008060000-0x000000000809C000-memory.dmp
memory/2576-11-0x0000000008040000-0x0000000008052000-memory.dmp
memory/2576-8-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/2576-6-0x0000000004F70000-0x0000000004F90000-memory.dmp
memory/2576-14-0x00000000080C0000-0x000000000810C000-memory.dmp
memory/2576-5-0x0000000000400000-0x0000000002CD0000-memory.dmp
memory/2576-15-0x0000000008250000-0x000000000835A000-memory.dmp
memory/2576-17-0x0000000002F00000-0x0000000003000000-memory.dmp
memory/2576-19-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/2576-20-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2576-21-0x0000000004F60000-0x0000000004F70000-memory.dmp