redline | a0edeedca466edcd53bebf63902f2fe35480908dd3bd6e465e8049b621f2017d

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf0c9b4cb8d22b9c1fe3b1f3527fbbbb.exe
Size

277KB
MD5

cf0c9b4cb8d22b9c1fe3b1f3527fbbbb
SHA1

58a8392f35098f119bb8405888ed7ce34fb7dfbe
SHA256

a0edeedca466edcd53bebf63902f2fe35480908dd3bd6e465e8049b621f2017d
SHA512

da7c7b16feb6a62d2ca01ffd596adfdcc53e440e4b9b831c84a125553f1d955544a20d6bfac5004e4042edfec5c5b740d71386d94f00de98fe89a1670213f607
SSDEEP

3072:5d7xakjkHsVlzylPeimPuvqsJ//quMJExNG2pubsE1DBef8Hz57uL59d3MgMdZaC:5ixplPc0pXquMeVY1eQCfdcb4cxb

Score

10^/10

redline sectoprat upd infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

upd

193.56.146.78:51487

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/224-6-0x0000000004DE0000-0x0000000004E04000-memory.dmp	family_redline
behavioral2/memory/224-9-0x0000000004E50000-0x0000000004E72000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/224-6-0x0000000004DE0000-0x0000000004E04000-memory.dmp	family_sectoprat
behavioral2/memory/224-7-0x00000000075F0000-0x0000000007600000-memory.dmp	family_sectoprat
behavioral2/memory/224-9-0x0000000004E50000-0x0000000004E72000-memory.dmp	family_sectoprat
behavioral2/memory/224-22-0x00000000075F0000-0x0000000007600000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\cf0c9b4cb8d22b9c1fe3b1f3527fbbbb.exe
"C:\Users\Admin\AppData\Local\Temp\cf0c9b4cb8d22b9c1fe3b1f3527fbbbb.exe"
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-1-0x0000000002D70000-0x0000000002E70000-memory.dmp

Filesize
1024KB

Download
memory/224-2-0x00000000048E0000-0x0000000004910000-memory.dmp

Filesize
192KB

Download
memory/224-3-0x0000000000400000-0x0000000002CD5000-memory.dmp

Filesize
40.8MB

Download
memory/224-4-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/224-5-0x0000000000400000-0x0000000002CD5000-memory.dmp

Filesize
40.8MB

Download
memory/224-6-0x0000000004DE0000-0x0000000004E04000-memory.dmp

Filesize
144KB

Download
memory/224-7-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/224-8-0x0000000007600000-0x0000000007BA4000-memory.dmp

Filesize
5.6MB

Download
memory/224-9-0x0000000004E50000-0x0000000004E72000-memory.dmp

Filesize
136KB

Download
memory/224-10-0x0000000007BB0000-0x00000000081C8000-memory.dmp

Filesize
6.1MB

Download
memory/224-11-0x0000000007470000-0x0000000007482000-memory.dmp

Filesize
72KB

Download
memory/224-12-0x0000000007490000-0x000000000759A000-memory.dmp

Filesize
1.0MB

Download
memory/224-13-0x0000000002D70000-0x0000000002E70000-memory.dmp

Filesize
1024KB

Download
memory/224-14-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/224-15-0x00000000075A0000-0x00000000075DC000-memory.dmp

Filesize
240KB

Download
memory/224-16-0x00000000048E0000-0x0000000004910000-memory.dmp

Filesize
192KB

Download
memory/224-18-0x0000000008200000-0x000000000824C000-memory.dmp

Filesize
304KB

Download
memory/224-19-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/224-20-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/224-22-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/224-23-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/224-25-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download