Analysis Overview
SHA256
99413087ffe7340e99989d09040ac13512349706ba56709703733da3dc4f2635
Threat Level: Known bad
The file 99413087ffe7340e99989d09040ac13512349706ba56709703733da3dc4f2635 was found to be: Known bad.
Malicious Activity Summary
RedLine payload
Redline family
SectopRAT payload
Sectoprat family
RedLine
SectopRAT
Unsigned PE
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-04-19 18:04
Signatures
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Sectoprat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-19 18:04
Reported
2024-04-19 18:07
Platform
win7-20240221-en
Max time kernel
147s
Max time network
154s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972.exe
"C:\Users\Admin\AppData\Local\Temp\861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ae1.localto.net | udp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
Files
memory/3008-0-0x00000000013C0000-0x00000000013DE000-memory.dmp
memory/3008-1-0x0000000074650000-0x0000000074D3E000-memory.dmp
memory/3008-2-0x0000000004B30000-0x0000000004B70000-memory.dmp
memory/3008-3-0x0000000074650000-0x0000000074D3E000-memory.dmp
memory/3008-4-0x0000000004B30000-0x0000000004B70000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-19 18:04
Reported
2024-04-19 18:07
Platform
win10v2004-20240226-en
Max time kernel
157s
Max time network
170s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972.exe
"C:\Users\Admin\AppData\Local\Temp\861ddbde9e32976e5a35a266c8a6eb8de0ded75940d03a99bb7d8ad5126ad972.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5060 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.118.77.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| US | 8.8.8.8:53 | chromewebstore.googleapis.com | udp |
| GB | 216.58.212.234:443 | chromewebstore.googleapis.com | tcp |
| US | 8.8.8.8:53 | 234.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ae1.localto.net | udp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| US | 8.8.8.8:53 | 85.65.42.20.in-addr.arpa | udp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
| AE | 129.151.142.36:8080 | ae1.localto.net | tcp |
Files
memory/2636-0-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/2636-1-0x0000000000730000-0x000000000074E000-memory.dmp
memory/2636-2-0x0000000005700000-0x0000000005D18000-memory.dmp
memory/2636-3-0x0000000005100000-0x0000000005112000-memory.dmp
memory/2636-4-0x0000000005160000-0x000000000519C000-memory.dmp
memory/2636-5-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/2636-6-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/2636-7-0x00000000053E0000-0x000000000542C000-memory.dmp
memory/2636-8-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/2636-9-0x0000000005D20000-0x0000000005E2A000-memory.dmp