Analysis
- max time kernel
138s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 04:38
General
- Target 8e3b34dd1d47ffb4589865061991914c.exe
- Size 373KB
- Sample240204-e9dtzacahq
- SHA256 69535464388f7106674d088e973bddb730c6eecf1364d056ccfefdb50a284ad4
Malware Config
Extracted
-
redline
-
@Kommunist2
-
45.87.3.183:2705
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3b34dd1d47ffb4589865061991914c.exe"C:\Users\Admin\AppData\Local\Temp\8e3b34dd1d47ffb4589865061991914c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8e3b34dd1d47ffb4589865061991914c.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
8e3b34dd1d47ffb4589865061991914c.exe.log
memory/1920-24-0x0000000004D50000-0x0000000004D60000-memory.dmp
memory/1920-23-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1920-22-0x0000000004D60000-0x0000000004DAC000-memory.dmp
memory/1920-20-0x0000000004D50000-0x0000000004D60000-memory.dmp
memory/1920-21-0x0000000004CE0000-0x0000000004D1C000-memory.dmp
memory/1920-17-0x00000000051D0000-0x00000000057E8000-memory.dmp
memory/1920-19-0x0000000004DB0000-0x0000000004EBA000-memory.dmp
memory/1920-18-0x0000000004C40000-0x0000000004C52000-memory.dmp
memory/1920-16-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/1920-12-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3608-7-0x00000000083A0000-0x000000000843C000-memory.dmp
memory/3608-14-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/3608-11-0x0000000008340000-0x0000000008362000-memory.dmp
memory/3608-10-0x00000000088E0000-0x000000000894E000-memory.dmp
memory/3608-9-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/3608-8-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/3608-6-0x0000000005B70000-0x0000000005B78000-memory.dmp
memory/3608-1-0x0000000075290000-0x0000000075A40000-memory.dmp
memory/3608-5-0x0000000005A80000-0x0000000005A8A000-memory.dmp
memory/3608-4-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/3608-3-0x00000000059C0000-0x0000000005A52000-memory.dmp
memory/3608-2-0x0000000005E80000-0x0000000006424000-memory.dmp
memory/3608-0-0x0000000000F70000-0x0000000000FD4000-memory.dmp