redline | f4eb31de9302b29f94e951cd77159b29ad6f36dc48dff1df573d13be632a0c16

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

953d93e24956822e11d1ff9e433731d4.exe
Size

300KB
MD5

953d93e24956822e11d1ff9e433731d4
SHA1

3f45bcca182046fa8957821089d804200227985d
SHA256

f4eb31de9302b29f94e951cd77159b29ad6f36dc48dff1df573d13be632a0c16
SHA512

c3791ebb2a90a82c4b937b58daa979a6e33d14606a5e89f398d56c8093d6582c76287576486c9292f0af00f7c7823147ef9d3993f47bb582b6f91c6fd9461137
SSDEEP

6144:OO4fR5dzAqA5UKLOCIbZy8ECbi/Q8bEcxb:OFfv+FExbU8/i/LEcF

Score

10^/10

redline sectoprat pub2 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

pub2

185.92.73.84:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2392-3-0x0000000004B90000-0x0000000004BB4000-memory.dmp	family_redline
behavioral2/memory/2392-10-0x0000000005060000-0x0000000005082000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2392-3-0x0000000004B90000-0x0000000004BB4000-memory.dmp	family_sectoprat
behavioral2/memory/2392-10-0x0000000005060000-0x0000000005082000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\953d93e24956822e11d1ff9e433731d4.exe
"C:\Users\Admin\AppData\Local\Temp\953d93e24956822e11d1ff9e433731d4.exe"
1⤵
PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-2-0x0000000002E80000-0x0000000002EB0000-memory.dmp

Filesize
192KB

Download
memory/2392-1-0x0000000002ED0000-0x0000000002FD0000-memory.dmp

Filesize
1024KB

Download
memory/2392-3-0x0000000004B90000-0x0000000004BB4000-memory.dmp

Filesize
144KB

Download
memory/2392-4-0x0000000000400000-0x0000000002CDB000-memory.dmp

Filesize
40.9MB

Download
memory/2392-7-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-6-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-5-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-8-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/2392-10-0x0000000005060000-0x0000000005082000-memory.dmp

Filesize
136KB

Download
memory/2392-9-0x0000000007570000-0x0000000007B14000-memory.dmp

Filesize
5.6MB

Download
memory/2392-11-0x0000000007B20000-0x0000000008138000-memory.dmp

Filesize
6.1MB

Download
memory/2392-12-0x0000000007470000-0x0000000007482000-memory.dmp

Filesize
72KB

Download
memory/2392-13-0x0000000008140000-0x000000000824A000-memory.dmp

Filesize
1.0MB

Download
memory/2392-14-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-15-0x0000000007490000-0x00000000074CC000-memory.dmp

Filesize
240KB

Download
memory/2392-16-0x0000000007510000-0x000000000755C000-memory.dmp

Filesize
304KB

Download
memory/2392-17-0x0000000000400000-0x0000000002CDB000-memory.dmp

Filesize
40.9MB

Download
memory/2392-18-0x0000000002ED0000-0x0000000002FD0000-memory.dmp

Filesize
1024KB

Download
memory/2392-20-0x0000000002E80000-0x0000000002EB0000-memory.dmp

Filesize
192KB

Download
memory/2392-23-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-22-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-21-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download
memory/2392-24-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/2392-25-0x0000000007560000-0x0000000007570000-memory.dmp

Filesize
64KB

Download