Overview

overview

10

Static

static

10

9850a146e6...1a.exe

windows7-x64

10

9850a146e6...1a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-02-2024 03:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9850a146e69faa57ef437bf9cb7a781a.exe

  • Size

    368KB

  • MD5

    9850a146e69faa57ef437bf9cb7a781a

  • SHA1

    2bfa93d24a6772db3f760268a65c7113d3113114

  • SHA256

    c17e4fa4530f011bef743905ab7e5e176a6e30f0b92ffcc7f27ed2e40d89f3f0

  • SHA512

    ca993da6a830464d82e395ddb60579117b42bccce22785ae81b7f428c7b4297e4dc104fc57a5fdcde3feabfec174748e84dc6fb24cf59c24717aa734474ab8f5

  • SSDEEP

    3072:ei86Adib5AYQzaiO3PulyddHsv/MJeGVMUUs:N7AdOiYz4yYwemUs

Score
10/10
redlinesectoprat35infostealerrattrojan

Malware Config

Extracted

Family

redline

Botnet

35

C2

45.144.29.222:17722

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9850a146e69faa57ef437bf9cb7a781a.exe
    "C:\Users\Admin\AppData\Local\Temp\9850a146e69faa57ef437bf9cb7a781a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2924-0-0x0000000000180000-0x00000000001E0000-memory.dmp
    Filesize

    384KB

    Download
  • memory/2924-1-0x0000000075000000-0x00000000757B0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2924-2-0x00000000051B0000-0x0000000005754000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/2924-3-0x0000000005D80000-0x0000000006398000-memory.dmp
    Filesize

    6.1MB

    Download
  • memory/2924-4-0x0000000004D70000-0x0000000004E02000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2924-5-0x0000000004D30000-0x0000000004D42000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2924-6-0x0000000004E50000-0x0000000004E8C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/2924-7-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2924-8-0x0000000005C10000-0x0000000005C5C000-memory.dmp
    Filesize

    304KB

    Download
  • memory/2924-9-0x0000000007710000-0x000000000781A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2924-10-0x0000000075000000-0x00000000757B0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/2924-11-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
    Filesize

    64KB

    Download