Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 10:38
General
- Target 8eef6d2361a4ba46c76fc7390211ef50.exe
- Size 497KB
- Sample240204-mpfrtshffp
- SHA256 8a269b9cb003cde07e1b18b16cc59384343be9a9cb5ab71cb6f82ee5e2cd130b
Malware Config
Extracted
-
redline
-
3
-
45.88.107.116:44061
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eef6d2361a4ba46c76fc7390211ef50.exe"C:\Users\Admin\AppData\Local\Temp\8eef6d2361a4ba46c76fc7390211ef50.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8eef6d2361a4ba46c76fc7390211ef50.exe"C:\Users\Admin\AppData\Local\Temp\8eef6d2361a4ba46c76fc7390211ef50.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 11122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 468 -ip 4681⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/468-19-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/468-1-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/468-2-0x0000000004E20000-0x0000000004EBC000-memory.dmp
memory/468-3-0x0000000005530000-0x0000000005AD4000-memory.dmp
memory/468-4-0x0000000004F80000-0x0000000005012000-memory.dmp
memory/468-5-0x0000000004E10000-0x0000000004E20000-memory.dmp
memory/468-6-0x0000000004F40000-0x0000000004F4A000-memory.dmp
memory/468-7-0x0000000005170000-0x00000000051C6000-memory.dmp
memory/468-8-0x0000000005130000-0x000000000514E000-memory.dmp
memory/468-10-0x0000000005240000-0x0000000005248000-memory.dmp
memory/468-0-0x0000000000570000-0x00000000005F0000-memory.dmp
memory/4552-9-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4552-13-0x00000000052E0000-0x00000000058F8000-memory.dmp
memory/4552-14-0x0000000004D00000-0x0000000004D12000-memory.dmp
memory/4552-15-0x0000000004E30000-0x0000000004F3A000-memory.dmp
memory/4552-16-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/4552-17-0x0000000004D60000-0x0000000004D9C000-memory.dmp
memory/4552-18-0x0000000004DA0000-0x0000000004DEC000-memory.dmp
memory/4552-12-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/4552-20-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/4552-21-0x00000000050F0000-0x0000000005100000-memory.dmp