Analysis
- max time kernel
157s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/02/2024, 07:58
General
- Target 98e380a1b54840a29eb84c217a96028b.exe
- Size 365KB
- Sample240213-jt3wdaed47
- SHA256 d673b8f790d1a92b00b4cfe07f962747116b63dfade5c4772d085ae37878305f
Malware Config
Extracted
-
redline
-
@RobinVVood
-
188.130.139.12:23747
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98e380a1b54840a29eb84c217a96028b.exe"C:\Users\Admin\AppData\Local\Temp\98e380a1b54840a29eb84c217a96028b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\98e380a1b54840a29eb84c217a96028b.exeC:\Users\Admin\AppData\Local\Temp\98e380a1b54840a29eb84c217a96028b.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/960-13-0x00000000054F0000-0x0000000005582000-memory.dmp
memory/960-9-0x0000000005940000-0x0000000005EE4000-memory.dmp
memory/960-18-0x0000000008010000-0x000000000805C000-memory.dmp
memory/960-17-0x0000000005760000-0x0000000005770000-memory.dmp
memory/960-16-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/960-8-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/960-15-0x00000000055D0000-0x000000000560C000-memory.dmp
memory/960-7-0x0000000000400000-0x000000000041E000-memory.dmp
memory/960-14-0x0000000005480000-0x0000000005492000-memory.dmp
memory/960-12-0x0000000006510000-0x0000000006B28000-memory.dmp
memory/3004-5-0x0000000000CB0000-0x0000000000CCE000-memory.dmp
memory/3004-11-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/3004-0-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/3004-1-0x0000000000710000-0x0000000000772000-memory.dmp
memory/3004-6-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/3004-4-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
memory/3004-3-0x00000000050E0000-0x0000000005156000-memory.dmp
memory/3004-2-0x00000000747C0000-0x0000000074F70000-memory.dmp