Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:05
Static task
static1
Behavioral task
behavioral1
Sample
74ee62c8c771189f2e927878eeff9f3a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
74ee62c8c771189f2e927878eeff9f3a.exe
Resource
win10v2004-20231215-en
General
-
Target
74ee62c8c771189f2e927878eeff9f3a.exe
-
Size
1.1MB
-
MD5
74ee62c8c771189f2e927878eeff9f3a
-
SHA1
faa5ca94d3a88a601603bfb1b6b42d3de819f38e
-
SHA256
c4f3d4c62f17140781474459bfeae6a353004163ad0ed4821a99f462bf30238a
-
SHA512
e3f59fef593b445a28c50756fae7b5974517ea53edda3f6df1aa917c8a8a640d1f76e9672a585aff34975418da910cdc0d66e80d9b6dd1c70f3c940a15e1c946
-
SSDEEP
24576:y37bNIka//RpA4wP/as8RXAqWNtK5tpNkcnLEkonHEiqqYug:y37Ska//RpApqOtwN4kuU5ug
Malware Config
Extracted
redline
@Gogowork11
185.206.215.216:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3340-1-0x00000000001D0000-0x0000000000556000-memory.dmp family_sectoprat -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
74ee62c8c771189f2e927878eeff9f3a.exepid process 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe 3340 74ee62c8c771189f2e927878eeff9f3a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
74ee62c8c771189f2e927878eeff9f3a.exepid process 3340 74ee62c8c771189f2e927878eeff9f3a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3340-0-0x00000000001D0000-0x0000000000556000-memory.dmpFilesize
3.5MB
-
memory/3340-2-0x0000000074210000-0x00000000749C0000-memory.dmpFilesize
7.7MB
-
memory/3340-1-0x00000000001D0000-0x0000000000556000-memory.dmpFilesize
3.5MB
-
memory/3340-3-0x0000000006450000-0x0000000006A68000-memory.dmpFilesize
6.1MB
-
memory/3340-4-0x0000000005EF0000-0x0000000005F02000-memory.dmpFilesize
72KB
-
memory/3340-5-0x0000000006020000-0x000000000612A000-memory.dmpFilesize
1.0MB
-
memory/3340-6-0x0000000005F50000-0x0000000005F8C000-memory.dmpFilesize
240KB
-
memory/3340-7-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB
-
memory/3340-8-0x0000000005F90000-0x0000000005FDC000-memory.dmpFilesize
304KB
-
memory/3340-11-0x00000000001D0000-0x0000000000556000-memory.dmpFilesize
3.5MB
-
memory/3340-12-0x0000000074210000-0x00000000749C0000-memory.dmpFilesize
7.7MB
-
memory/3340-13-0x0000000006250000-0x0000000006260000-memory.dmpFilesize
64KB