Analysis
- max time kernel
141s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/02/2024, 08:49
General
- Target 86735dcda6184ee39085d934e6f51d64.exe
- Size 372KB
- Sample240201-kreansabcj
- SHA256 a2213b4c900da6664ae1f90664104825d7c13119ce643cbe845d30b460f6b2fc
Malware Config
Extracted
-
redline
-
790188959
-
188.40.193.166:43180
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86735dcda6184ee39085d934e6f51d64.exe"C:\Users\Admin\AppData\Local\Temp\86735dcda6184ee39085d934e6f51d64.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\86735dcda6184ee39085d934e6f51d64.exeC:\Users\Admin\AppData\Local\Temp\86735dcda6184ee39085d934e6f51d64.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
86735dcda6184ee39085d934e6f51d64.exe.log
memory/4512-0-0x0000000000680000-0x00000000006E4000-memory.dmp
memory/4512-1-0x0000000075050000-0x0000000075800000-memory.dmp
memory/4512-2-0x0000000005050000-0x00000000050C6000-memory.dmp
memory/4512-4-0x0000000005000000-0x000000000501E000-memory.dmp
memory/4512-3-0x0000000005230000-0x0000000005240000-memory.dmp
memory/4512-5-0x00000000057F0000-0x0000000005D94000-memory.dmp
memory/4512-9-0x0000000075050000-0x0000000075800000-memory.dmp
memory/4672-10-0x0000000005510000-0x0000000005B28000-memory.dmp
memory/4672-12-0x00000000050D0000-0x00000000050E2000-memory.dmp
memory/4672-11-0x0000000075050000-0x0000000075800000-memory.dmp
memory/4672-6-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4672-13-0x0000000005130000-0x000000000516C000-memory.dmp
memory/4672-15-0x0000000005170000-0x00000000051BC000-memory.dmp
memory/4672-14-0x00000000051E0000-0x00000000051F0000-memory.dmp
memory/4672-16-0x00000000053E0000-0x00000000054EA000-memory.dmp
memory/4672-17-0x0000000075050000-0x0000000075800000-memory.dmp
memory/4672-18-0x00000000051E0000-0x00000000051F0000-memory.dmp