Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
04/02/2024, 08:19
General
- Target 8ea9c555c6a53b7dee50185e6a7b2020.exe
- Size 2.1MB
- Sample240204-j8a4xadbd2
- SHA256 6094096f91caf7c2f762b5c51c945c796fc5522dcb07891458cba8fafddfa564
Malware Config
Extracted
-
redline
-
s1ncer
-
185.172.129.61:52372
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 17 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ea9c555c6a53b7dee50185e6a7b2020.exe"C:\Users\Admin\AppData\Local\Temp\8ea9c555c6a53b7dee50185e6a7b2020.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1864-0-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-1-0x000000007F4F0000-0x000000007F8C1000-memory.dmp
memory/1864-2-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/1864-3-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-4-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-6-0x0000000007230000-0x0000000007242000-memory.dmp
memory/1864-7-0x0000000007290000-0x00000000072CC000-memory.dmp
memory/1864-5-0x0000000007810000-0x0000000007E28000-memory.dmp
memory/1864-9-0x00000000072D0000-0x000000000731C000-memory.dmp
memory/1864-8-0x0000000007330000-0x0000000007340000-memory.dmp
memory/1864-10-0x0000000007530000-0x000000000763A000-memory.dmp
memory/1864-11-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-12-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-13-0x000000007F4F0000-0x000000007F8C1000-memory.dmp
memory/1864-14-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-15-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/1864-16-0x0000000007330000-0x0000000007340000-memory.dmp
memory/1864-17-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-18-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-19-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-20-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-21-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-22-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-23-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-24-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-25-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-26-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-27-0x0000000000F50000-0x0000000001876000-memory.dmp
memory/1864-28-0x0000000000F50000-0x0000000001876000-memory.dmp