redline | d2502a1553d0149e46dd657222d34bb88320de8c757d7c59d934a3c60699bea8

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a73d70d350fabb83da0b6492a44f300.exe
Size 2.3MB
Sample240214-b6sbeafb92
SHA256 d2502a1553d0149e46dd657222d34bb88320de8c757d7c59d934a3c60699bea8
MD5 9a73d70d350fabb83da0b6492a44f300
SHA1 f46871ee0416f6586ae4e350fc08b699c4bb7224
SHA512 8ab9cff89776dd91ade43e6d9c6d886cbf0ea5d4faa79ba2be1c0b6e4b443013725f578cc55b63d4e0d75366d3317b3964ad16fd7589283a4dbc6c1514dd3f47
SSDEEP 49152:aNYkC24+agb3A2FUG7EVJGaLU4notKFExiz8lVHTIioOFZQ+M:aNkdTJGLt4ExiqZ7M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat @yosiphy infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@YosiphY

45.14.12.90:52072

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023256-76.dat	family_redline
behavioral2/memory/2892-77-0x00000000001D0000-0x00000000001EE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023256-76.dat	family_sectoprat
behavioral2/memory/2892-77-0x00000000001D0000-0x00000000001EE000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	9a73d70d350fabb83da0b6492a44f300.exe

Executes dropped EXE 11 IoCs

pid	Process
1896	7z.exe
1592	7z.exe
2848	7z.exe
3572	7z.exe
1308	7z.exe
4572	7z.exe
3084	7z.exe
2968	7z.exe
4168	7z.exe
3112	7z.exe
2892	YosiphY.exe

Loads dropped DLL 10 IoCs

pid	Process
1896	7z.exe
1592	7z.exe
2848	7z.exe
3572	7z.exe
1308	7z.exe
4572	7z.exe
3084	7z.exe
2968	7z.exe
4168	7z.exe
3112	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeRestorePrivilege	1896	7z.exe
Token: 35	1896	7z.exe
Token: SeSecurityPrivilege	1896	7z.exe
Token: SeSecurityPrivilege	1896	7z.exe
Token: SeRestorePrivilege	1592	7z.exe
Token: 35	1592	7z.exe
Token: SeSecurityPrivilege	1592	7z.exe
Token: SeSecurityPrivilege	1592	7z.exe
Token: SeRestorePrivilege	2848	7z.exe
Token: 35	2848	7z.exe
Token: SeSecurityPrivilege	2848	7z.exe
Token: SeSecurityPrivilege	2848	7z.exe
Token: SeRestorePrivilege	3572	7z.exe
Token: 35	3572	7z.exe
Token: SeSecurityPrivilege	3572	7z.exe
Token: SeSecurityPrivilege	3572	7z.exe
Token: SeRestorePrivilege	1308	7z.exe
Token: 35	1308	7z.exe
Token: SeSecurityPrivilege	1308	7z.exe
Token: SeSecurityPrivilege	1308	7z.exe
Token: SeRestorePrivilege	4572	7z.exe
Token: 35	4572	7z.exe
Token: SeSecurityPrivilege	4572	7z.exe
Token: SeSecurityPrivilege	4572	7z.exe
Token: SeRestorePrivilege	3084	7z.exe
Token: 35	3084	7z.exe
Token: SeSecurityPrivilege	3084	7z.exe
Token: SeSecurityPrivilege	3084	7z.exe
Token: SeRestorePrivilege	2968	7z.exe
Token: 35	2968	7z.exe
Token: SeSecurityPrivilege	2968	7z.exe
Token: SeSecurityPrivilege	2968	7z.exe
Token: SeRestorePrivilege	4168	7z.exe
Token: 35	4168	7z.exe
Token: SeSecurityPrivilege	4168	7z.exe
Token: SeSecurityPrivilege	4168	7z.exe
Token: SeRestorePrivilege	3112	7z.exe
Token: 35	3112	7z.exe
Token: SeSecurityPrivilege	3112	7z.exe
Token: SeSecurityPrivilege	3112	7z.exe
Token: SeDebugPrivilege	2892	YosiphY.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3808	4112	9a73d70d350fabb83da0b6492a44f300.exe	85
PID 4112 wrote to memory of 3808	4112	9a73d70d350fabb83da0b6492a44f300.exe	85
PID 3808 wrote to memory of 3140	3808	cmd.exe	87
PID 3808 wrote to memory of 3140	3808	cmd.exe	87
PID 3808 wrote to memory of 1896	3808	cmd.exe	88
PID 3808 wrote to memory of 1896	3808	cmd.exe	88
PID 3808 wrote to memory of 1592	3808	cmd.exe	89
PID 3808 wrote to memory of 1592	3808	cmd.exe	89
PID 3808 wrote to memory of 2848	3808	cmd.exe	90
PID 3808 wrote to memory of 2848	3808	cmd.exe	90
PID 3808 wrote to memory of 3572	3808	cmd.exe	91
PID 3808 wrote to memory of 3572	3808	cmd.exe	91
PID 3808 wrote to memory of 1308	3808	cmd.exe	100
PID 3808 wrote to memory of 1308	3808	cmd.exe	100
PID 3808 wrote to memory of 4572	3808	cmd.exe	92
PID 3808 wrote to memory of 4572	3808	cmd.exe	92
PID 3808 wrote to memory of 3084	3808	cmd.exe	99
PID 3808 wrote to memory of 3084	3808	cmd.exe	99
PID 3808 wrote to memory of 2968	3808	cmd.exe	93
PID 3808 wrote to memory of 2968	3808	cmd.exe	93
PID 3808 wrote to memory of 4168	3808	cmd.exe	98
PID 3808 wrote to memory of 4168	3808	cmd.exe	98
PID 3808 wrote to memory of 3112	3808	cmd.exe	94
PID 3808 wrote to memory of 3112	3808	cmd.exe	94
PID 3808 wrote to memory of 2664	3808	cmd.exe	97
PID 3808 wrote to memory of 2664	3808	cmd.exe	97
PID 3808 wrote to memory of 2892	3808	cmd.exe	95
PID 3808 wrote to memory of 2892	3808	cmd.exe	95
PID 3808 wrote to memory of 2892	3808	cmd.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2664	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9a73d70d350fabb83da0b6492a44f300.exe
"C:\Users\Admin\AppData\Local\Temp\9a73d70d350fabb83da0b6492a44f300.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ready\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e file.zip -p___________28389pwd24803pwd15821___________ -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_9.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_8.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_7.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_5.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\ready\YosiphY.exe
    "YosiphY.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\system32\attrib.exe
    attrib +H "YosiphY.exe"
    3⤵
    - Views/modifies file attributes
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
    7z.exe e extracted/file_6.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\ready\7z.dll
Size 1.6MB
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\ready\7z.dll
Size 1.3MB
SHA256 f15b48731890b28d6a50b217e55be987b55f8d0910966cb5113d8fed04d1aa55
MD5 7443b96a546a7225276df7bf26aafc55
SHA1 e47142d46aa89c6a4da326a486a742e4f51a5806
SHA512 66453985fc7ea7a40c4b5a88c580a1540469ed89f55c8da583c16211cb4ea4d9ea3e9973a271320fe431d8cb214feba2007bfe6454c7c19b92fb1947c46f962e
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxA:jclmJSVARa86xzW3xRoyqqxA
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\ready\7z.dll
Size 1.1MB
SHA256 ae03f23f4d97040d4c2bb28f4abdfa8a8371e0c5c7926fff7032689caeb7c57c
MD5 ed083f5e95cafbd0123b9d6871a09de9
SHA1 e58a1cdb8be2989313128ba3ad3e137de87573cb
SHA512 8c84e906ceaa7666490a0e4c40e5552e46b4532b0e91fc8b3433849a67b3c5c12cfe60a80b6209b2d7853a68037859c1a5fc41d3c671303ba14c346eccd115a6
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zp:jclmJSVARa86xzW3xRop
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

YosiphY.exe

Path C:\Users\Admin\AppData\Local\Temp\ready\YosiphY.exe
Size 99KB
SHA256 b71efc9c9bec264edf4ac9cb0c37e8dff7b567be7bd5cbaab3d6788b6ce6e5e7
MD5 f659223e10ff6c2513466922c5627f6d
SHA1 40899441cc101a14d9318bafc1d88fa049463414
SHA512 c11f2164d4b2f2d733b53e0520ffd7cb8a3991bbdea1160ed9018c022eea354642dd456461ae612bf34a8341b3d8c8a7ee25d01d1579629ff571c1834d3c1920
SSDEEP 1536:x3LNmocUkjZ9swzOn64YlM4yxKJFxMcmbfexvCuvUyyedNQ8yqCxXsE5G6ijoiga:xxmocoP6VlMXoJLMxgCucyzdVSnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\ANTIAV~1.DAT
Size 960KB
SHA256 3d5050bf79b9c6fb62f840150736d6e5abef2fc6fbb70df118c500fc5c588cd1
MD5 3483f2deede2d9fef60a11e6130fc6e0
SHA1 1d3ee0e27b7dcd9f79789f992a506140847952bd
SHA512 2102a0f3f7ed82daf5ab34d3fee51c4b5b3d79113b3bd711aa287cd98f1d48d1ab75287f260ccee03b6586428f8794a1bb6ddc30eb62f5ace3353b631fbf3984
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92y:R9kqGu7oy
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_1.zip
Size 40KB
SHA256 75dcb94be4b4b8c237e8935c065218184df28504d469a39734546c0bad8a297d
MD5 f1f7f00471f9776aee3fecc6a7fe5d28
SHA1 a95de8ee6ad4053e07a8e9858bd9189a477bb312
SHA512 c7ee42ef25818995a58b3e476141eb3a207bc3e2b4d0908edb4e2bbf4db52d0ad5b57024ac680fcaa65dbaec0484c68d7eee7d1cd0b093837858cdc6266dd77e
SSDEEP 768:hCynnzICiizZSoMGGTSFsOGwKLSbrnf/XlN0o+NM3pxv2SNLi6d:hCy8zizW1KjGFSfnf9So5xv2SZJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_2.zip
Size 40KB
SHA256 58443b790d4bde291503852ceb73f73cf745673cab167c453c78f67cd4bb06b1
MD5 9ce5ba6ac8a365fa5fafa7c79c6f3091
SHA1 4d2dfa2e953d0ccdd6bc97160757097f259b26e5
SHA512 40b489b2d498376d77d2ca07b201327b69a2322639af8a6b72ea06e639bc22c6ae81542fe9997789024c630cdddb857da8961503a7c0cb66d448cb17c12f17b1
SSDEEP 768:9CynnzICiizZSoMGGTZCjz2YQtfcmNi6mX85v+hi12SNLi6E:9Cy8zizW1VCmVtkmNinSv+Y12SZJE
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_3.zip
Size 40KB
SHA256 ce18b32963078b81bcfcce9dc489db701ebe0bdbe778eb62deface5d7d9f37b2
MD5 cae3507f295e817af824b2f4cbfd101b
SHA1 bb2c745bcead630549451304d170b747882b014d
SHA512 31978545ea82b3a926aa74b1832868ae1812b85c8a1a7a0c12327418d94de59466a4a0e0997ff5e8bcd22845f1d6870641edb7bf49c2ffc8616c321628b04b4a
SSDEEP 768:gCynnzICiizZSoMGGTlCjz2YQtfemNi6mX85v+hi9zwjbeL+6ks:gCy8zizW1ZCmVtWmNinSv+Y9jl
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_4.zip
Size 40KB
SHA256 65562255f02531214ef592df711149862fa2a3fad0c081d59d1380f39dfc6928
MD5 654bcf0e3b4fc75a25054e750383d772
SHA1 66a7a64c31dba8a7d9416d0479960f97eecb87a5
SHA512 da734f7b9f4aae1e850096c9ce51d6d355fbab1fd2dddd0c8f1805951421aed63260d36e16457404f317784b4baf27adf2fd7eac4e9dc579a60eacbfd7eb995a
SSDEEP 768:wCynnzICiizZSoMGGTlCjz2YQtfemNi6mX85v+hi9zwjbeL+6kU:wCy8zizW1ZCmVtWmNinSv+Y9jh
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_5.zip
Size 40KB
SHA256 5d11d4e78d8488283fbd5a634f561f2b9618c9718fd9f85ce469135460963e78
MD5 23f33f1e2943cc21090ec495563ab54b
SHA1 4dea57185a36aebee39c13209bf81ae60a33e4d4
SHA512 f8335095a32838267e9ed736a582422d9492888886c66eb559a648d4db1f95f67adc04669410f1161497fc9a15cc2e20dbaed0091f94b2a2ee3d76c3835891be
SSDEEP 768:v993qf077fTe4xv6dJCjz2YQtf2mNi6mX85v+hiGaKXkkJAVh:v9579BaJCmVtemNinSv+YGa4Jih
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_6.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_6.zip
Size 41KB
SHA256 49fb81877c723e23449e8ae96ed203a7b259d82b5f536291c2e88cec4b99ab20
MD5 dea6286843c46f0908d5256ead1b545c
SHA1 14446438228f7e816c432c3ffc13a85056b2de3d
SHA512 7e7297edae5f962a5accba42f5c73d2959479b4d4f03e4c4924128f067d077adee69199d48b2a8b4c5ad04f4f6ffb49b9df573ba4f7096802e9c8c2cbae17552
SSDEEP 768:L993qf077fTe4xv6dJCjz2YQtf2mNi6mX85v+hiGaKXkkJAVi:L9579BaJCmVtemNinSv+YGa4Jii
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_7.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_7.zip
Size 41KB
SHA256 610f480b3a830ef59aa945a845aed562c80f3970956ce46f1e45cb3d49d0f57b
MD5 2c31c794eef45f88c01a70804b85190d
SHA1 26b25569576c81564dba7b52ca8fab952b6b82bc
SHA512 7bfd51c2212e2a07c1cfdc29890e9fc62d869859e3187c50d817608b88144b1de8deb196681fb4835b74a77217d4c6000463cc8da3caec6aa867b1c1fcc27fd1
SSDEEP 768:k993qf077fTe4xv6hJCjz2YQt12mNi6mX85v+hiE8IHcEDFHc:k9579BkJCmVt8mNinSv+YjEcyc
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_8.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_8.zip
Size 41KB
SHA256 19a489731e24d25172364dd489b47d460ae7c7e4099051e12453df8002c8083a
MD5 77dd1a94499d9643957d5062671849ba
SHA1 cb35a16608329ead67f6af4950399e193f79738a
SHA512 f0f5f94ae7e6c657d1f04af53a49318635ca0c1569b2965c8f38feab882b1fc7ab4e4c5f8102a04a4f66d771d4474654d6d66f1055cc14f675644533a7551bd2
SSDEEP 768:g993qf077fTe4xv6hJCjz2YQt12mNi6mX85v+hiE8IHcEDFHM:g9579BkJCmVt8mNinSv+YjEcyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_9.zip

Path C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_9.zip
Size 1.5MB
SHA256 e37ca8523f450dfdb2e685c2dff591dea3c0f1283878feab44e1edb43910336d
MD5 edf865db8ca10e3d1fd8f4d64170acee
SHA1 777f11160a4fe200ffc5c06f8c3bffeb3198c71d
SHA512 fd8db0ad6e657f838dfa952927f1536c0b6f7abd9777d97870742d8c64cd975ac217ae51ba269206e1c6c6b62224ca620dfa6ab75648f2fc36b5de9f1d69e93b
SSDEEP 24576:LbI/7AAb+JQl3Vd02kOC/l5X4/KiROMdWbBkDC6SX39qbwK1ZNKdvLI6F:LujCK3D0AC/l5mwbBkDWYb1ZN4UC
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\ready\file.bin
Size 1.5MB
SHA256 4d3d8cf03e47206b92fe39db188247c2dc5e84ecc32a81fd300f9d528c14b3a9
MD5 4e8589a72f80709e880cc3b071e7c862
SHA1 72ac622150aaf2b44d96069e0db49e8a28a77f41
SHA512 86d14f1ea53ede244d62f3e28c28f654d69c36aa9ec5947e2715c4dac27deddaeeb797b327b6a76ce78cac5c6fb4653c08362650ef70d47bf2ca29ad6d03f105
SSDEEP 24576:EwdWgN6SVgwaF90dcaje7Y6VVrG0JMBV5rQaAUI4+4nKbtKEdL:Zk46agb0nq82GI6VdQa8R4nCtKEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\ready\main.bat
Size 485B
SHA256 bfb5f3e7315ba58fc7dee7a2a5c3fb93931fb73760ef252953c30ea07420ec2a
MD5 0b19c42ac120460232e7a3e84942dee7
SHA1 0711921117c68c0e6216332465fdfedd2e78e589
SHA512 e4de1212dc56a5eafb919bd41cd8699e0a1bd5af02fd49a0b358de1c03ca9159efca8c27b9a66adbb91c65005f84c8bd3f54b61b8f2bf89fd06aedef687424e2
MD5 SHA1 SHA512

Submit Download

memory/2892-82-0x0000000004E00000-0x0000000004E12000-memory.dmp

Download

memory/2892-80-0x0000000073360000-0x0000000073B10000-memory.dmp

Download

memory/2892-77-0x00000000001D0000-0x00000000001EE000-memory.dmp

Download

memory/2892-81-0x0000000005E00000-0x0000000006418000-memory.dmp

Download

memory/2892-79-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Download

memory/2892-78-0x0000000005230000-0x00000000057D4000-memory.dmp

Download

memory/2892-83-0x0000000005100000-0x000000000513C000-memory.dmp

Download

memory/2892-85-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Download

memory/2892-84-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/2892-86-0x0000000005CD0000-0x0000000005DDA000-memory.dmp

Download

memory/2892-87-0x0000000073360000-0x0000000073B10000-memory.dmp

Download

memory/2892-88-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads