Analysis

  • max time kernel
    155s
  • max time network
    173s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 07:23

General

  • Target

    5aa0f6fe71bfa5d534e6b0c54181aed1.exe

  • Size

    399KB

  • MD5

    5aa0f6fe71bfa5d534e6b0c54181aed1

  • SHA1

    fe113ced2df6f9b01c617a039a6e040f7e935dac

  • SHA256

    540696411a1e0440408c5372571ad0ff5e67230d62cbd8533b6338e03b85cf79

  • SHA512

    f7d110169e74ca8ce09aa67fd1b56567f1d42fdcebe822c4d608dde7300e441db68e6b51213d49a5c40d006ef20db4ff74689c33f37814d2267a3689f6e878b6

  • SSDEEP

    6144:lJCUD10/h1zbK9j32mBgwlsSJHY5yF9Ml1dXsbe9VKNTsJRJggT:5qEFXlLHY5M6sbe9VKN8RJfT

Malware Config

Extracted

Family

redline

Botnet

@a0867183086d949f0c153b3bbcf46510

C2

95.215.207.185:64399

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 7 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5aa0f6fe71bfa5d534e6b0c54181aed1.exe
    "C:\Users\Admin\AppData\Local\Temp\5aa0f6fe71bfa5d534e6b0c54181aed1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\5aa0f6fe71bfa5d534e6b0c54181aed1.exe
      "{path}"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2472

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1728-0-0x0000000001310000-0x000000000137A000-memory.dmp

          Filesize

          424KB

        • memory/1728-1-0x0000000073F00000-0x00000000745EE000-memory.dmp

          Filesize

          6.9MB

        • memory/1728-2-0x0000000004C90000-0x0000000004CD0000-memory.dmp

          Filesize

          256KB

        • memory/1728-3-0x0000000000550000-0x0000000000558000-memory.dmp

          Filesize

          32KB

        • memory/1728-4-0x0000000073F00000-0x00000000745EE000-memory.dmp

          Filesize

          6.9MB

        • memory/1728-5-0x0000000004C90000-0x0000000004CD0000-memory.dmp

          Filesize

          256KB

        • memory/1728-6-0x0000000005D10000-0x0000000005D84000-memory.dmp

          Filesize

          464KB

        • memory/1728-7-0x0000000000DE0000-0x0000000000E04000-memory.dmp

          Filesize

          144KB

        • memory/1728-20-0x0000000073F00000-0x00000000745EE000-memory.dmp

          Filesize

          6.9MB

        • memory/2472-12-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-10-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-14-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2472-18-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-23-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-21-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-8-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2472-24-0x0000000073E80000-0x000000007456E000-memory.dmp

          Filesize

          6.9MB

        • memory/2472-25-0x0000000000D50000-0x0000000000D90000-memory.dmp

          Filesize

          256KB

        • memory/2472-26-0x0000000073E80000-0x000000007456E000-memory.dmp

          Filesize

          6.9MB

        • memory/2472-27-0x0000000000D50000-0x0000000000D90000-memory.dmp

          Filesize

          256KB