Overview

overview

10

Static

static

5

b539acc51a...ad.exe

windows7-x64

10

b539acc51a...ad.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08-07-2024 08:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe

  • Size

    1.0MB

  • MD5

    0a136df16d906821f105096987d43e11

  • SHA1

    5b4478cabb9e3d2673643235aa1980df5b2ea671

  • SHA256

    b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad

  • SHA512

    2f6b8014be9e4d2fc858fcf0b66690e3a6bc4dbd25ae7c52bd69c732dafa432b86ea6ffd45304d1fa9b58b8e6ee73ff6021a47b6158d0ea061f47c5590e812de

  • SSDEEP

    24576:AAHnh+eWsN3skA4RV1Hom2KXMmHa5R3MeYTslWVNB5:3h+ZkldoPK8Ya5R8eYSWVt

Score
10/10
redlinesectopratfrenchinfostealerratspywaretrojan

Malware Config

Extracted

Family

redline

Botnet

french

C2

91.92.243.245:47477

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe
    "C:\Users\Admin\AppData\Local\Temp\b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\b539acc51a48e2088f90ab0a82f60f38a784105712ef57542e8e1552a1c6aaad.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp2E0.tmp
    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\tmp305.tmp
    Filesize

    92KB

    MD5

    c61f0bee83c8a956f2cf4ceba90bebc9

    SHA1

    f4f61f0e65b7669be468cacaf8e00b2f30cb46cc

    SHA256

    601c578f842ad1a4c743f3bf049d691225697819abe9b75bfe156264412e28dc

    SHA512

    e6949a72e8bc26fd2910339ae75f22a36a0ad0bf9579bb2a0ada2ee2b8fb3a1b3891756eec774d4a64263e937c6ae768249e64874c559bb2f1b69d2d38bfceaa

    Download Submit
  • memory/1452-11-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1452-13-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1452-15-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1452-16-0x000000007405E000-0x000000007405F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1452-17-0x0000000074050000-0x000000007473E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1452-87-0x000000007405E000-0x000000007405F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1452-88-0x0000000074050000-0x000000007473E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1452-89-0x0000000074050000-0x000000007473E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1900-10-0x0000000000120000-0x0000000000124000-memory.dmp
    Filesize

    16KB

    Download