Analysis
- max time kernel
287s - max time network
303s - platform
windows10-1703_x64 - resource
win10-20231220-en - resource tags
- submitted
01/02/2024, 04:49
General
- Target 37d9584b8efd478bb1771cd8550a6d54d205eca40ceab3d08fc58146626f2aa4.exe
- Size 495KB
- Sample240201-ffwncsbfa4
- SHA256 37d9584b8efd478bb1771cd8550a6d54d205eca40ceab3d08fc58146626f2aa4
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
45.15.156.60:12050
Signatures
- Detect ZGRat V1 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37d9584b8efd478bb1771cd8550a6d54d205eca40ceab3d08fc58146626f2aa4.exe"C:\Users\Admin\AppData\Local\Temp\37d9584b8efd478bb1771cd8550a6d54d205eca40ceab3d08fc58146626f2aa4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/96-0-0x00000000000F0000-0x0000000000172000-memory.dmp
memory/96-2-0x0000000004A80000-0x0000000004A90000-memory.dmp
memory/96-1-0x00000000732E0000-0x00000000739CE000-memory.dmp
memory/96-19-0x0000000002470000-0x0000000004470000-memory.dmp
memory/96-10-0x0000000002470000-0x0000000004470000-memory.dmp
memory/96-9-0x00000000732E0000-0x00000000739CE000-memory.dmp
memory/3152-8-0x0000000005D90000-0x000000000628E000-memory.dmp
memory/3152-11-0x0000000005890000-0x0000000005922000-memory.dmp
memory/3152-12-0x00000000732E0000-0x00000000739CE000-memory.dmp
memory/3152-13-0x0000000005760000-0x000000000576A000-memory.dmp
memory/3152-15-0x0000000006290000-0x000000000639A000-memory.dmp
memory/3152-17-0x0000000005C70000-0x0000000005CAE000-memory.dmp
memory/3152-18-0x0000000005CB0000-0x0000000005CFB000-memory.dmp
memory/3152-16-0x0000000005C10000-0x0000000005C22000-memory.dmp
memory/3152-14-0x00000000068A0000-0x0000000006EA6000-memory.dmp
memory/3152-5-0x0000000000400000-0x0000000000454000-memory.dmp
memory/3152-20-0x00000000732E0000-0x00000000739CE000-memory.dmp