Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18-01-2024 20:15
Static task
static1
Behavioral task
behavioral1
Sample
65f02521e4d3d357608eb923fa6930f5.exe
Resource
win7-20231215-en
General
-
Target
65f02521e4d3d357608eb923fa6930f5.exe
-
Size
378KB
-
MD5
65f02521e4d3d357608eb923fa6930f5
-
SHA1
bc8165197cb12767ac93bc49922d1c7c67e2eb6b
-
SHA256
e3fcc56bcfd2108829e5bbb481f260e31828c4a38d93bc1ac294b48cff7245cc
-
SHA512
ee933f281dcc69f1dcac7975627c289b443cf14e6feb4863f8397c19a37e11d2f51baba85be740d962cc8d31347e763e03e486460e78a74cea32ecc423d61243
-
SSDEEP
6144:R2whUfR1GfxfRT4ROvAK+VZtJTiKBsM4d0WOFUehGhwPgdFHoU1:NhsR1GfxfRT4YoK+VZtJTZBsM4d0WOFS
Malware Config
Extracted
redline
777
185.203.243.131:27365
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-5-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2304-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2304-9-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2304-11-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2304-14-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2304-5-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2304-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2304-9-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2304-11-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2304-14-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
65f02521e4d3d357608eb923fa6930f5.exedescription pid process target process PID 2148 set thread context of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
65f02521e4d3d357608eb923fa6930f5.exedescription pid process Token: SeDebugPrivilege 2304 65f02521e4d3d357608eb923fa6930f5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
65f02521e4d3d357608eb923fa6930f5.exedescription pid process target process PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe PID 2148 wrote to memory of 2304 2148 65f02521e4d3d357608eb923fa6930f5.exe 65f02521e4d3d357608eb923fa6930f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exe"C:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exeC:\Users\Admin\AppData\Local\Temp\65f02521e4d3d357608eb923fa6930f5.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2148-0-0x0000000000340000-0x00000000003A4000-memory.dmpFilesize
400KB
-
memory/2148-1-0x0000000074130000-0x000000007481E000-memory.dmpFilesize
6.9MB
-
memory/2148-2-0x00000000002E0000-0x0000000000320000-memory.dmpFilesize
256KB
-
memory/2148-12-0x0000000074130000-0x000000007481E000-memory.dmpFilesize
6.9MB
-
memory/2304-6-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-5-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-3-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2304-9-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-11-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-4-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-14-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2304-15-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/2304-16-0x0000000004C20000-0x0000000004C60000-memory.dmpFilesize
256KB
-
memory/2304-17-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB