Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06-02-2024 19:00
General
-
Target
953d93e24956822e11d1ff9e433731d4.exe
-
Size
300KB
-
MD5
953d93e24956822e11d1ff9e433731d4
-
SHA1
3f45bcca182046fa8957821089d804200227985d
-
SHA256
f4eb31de9302b29f94e951cd77159b29ad6f36dc48dff1df573d13be632a0c16
-
SHA512
c3791ebb2a90a82c4b937b58daa979a6e33d14606a5e89f398d56c8093d6582c76287576486c9292f0af00f7c7823147ef9d3993f47bb582b6f91c6fd9461137
-
SSDEEP
6144:OO4fR5dzAqA5UKLOCIbZy8ECbi/Q8bEcxb:OFfv+FExbU8/i/LEcF
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
pub2
C2
185.92.73.84:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\953d93e24956822e11d1ff9e433731d4.exe"C:\Users\Admin\AppData\Local\Temp\953d93e24956822e11d1ff9e433731d4.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-1-0x0000000002E50000-0x0000000002F50000-memory.dmpFilesize
1024KB
-
memory/2020-2-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/2020-5-0x0000000007360000-0x00000000073A0000-memory.dmpFilesize
256KB
-
memory/2020-4-0x0000000000400000-0x0000000002CDB000-memory.dmpFilesize
40.9MB
-
memory/2020-3-0x0000000002D20000-0x0000000002D44000-memory.dmpFilesize
144KB
-
memory/2020-7-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/2020-6-0x0000000002E30000-0x0000000002E52000-memory.dmpFilesize
136KB
-
memory/2020-8-0x0000000007360000-0x00000000073A0000-memory.dmpFilesize
256KB
-
memory/2020-11-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/2020-10-0x0000000002E50000-0x0000000002F50000-memory.dmpFilesize
1024KB
-
memory/2020-13-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB