Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
26/07/2024, 19:14
General
- Target qcxtqseqebql.exe
- Size 906KB
- Sample240726-xxtzjascpc
- SHA256 4b39395783ee4f8ab3197c93738788d8f6b375bbe57a2f2337e5ba122bcd4fa8
Malware Config
Extracted
-
redline
-
cheat
-
154.81.220.233:28105
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\qcxtqseqebql.exe"C:\Users\Admin\AppData\Local\Temp\qcxtqseqebql.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2880-0-0x0000000000780000-0x0000000000781000-memory.dmp
memory/2880-4-0x0000000000780000-0x0000000000781000-memory.dmp
memory/2880-3-0x00007FFEA5DD0000-0x00007FFEA5FC5000-memory.dmp
memory/2880-6-0x0000000000400000-0x00000000004FF000-memory.dmp
memory/2880-9-0x00007FFE86933000-0x00007FFE86935000-memory.dmp
memory/2880-10-0x0000000003A60000-0x0000000003A7E000-memory.dmp
memory/2880-12-0x00007FFE86930000-0x00007FFE873F1000-memory.dmp
memory/2880-11-0x0000000003A90000-0x0000000003AA2000-memory.dmp
memory/2880-13-0x0000000003AB0000-0x0000000003AEC000-memory.dmp
memory/2880-14-0x00007FFE86930000-0x00007FFE873F1000-memory.dmp
memory/2880-15-0x00007FFE86930000-0x00007FFE873F1000-memory.dmp
memory/2880-16-0x0000000000400000-0x00000000004FF000-memory.dmp
memory/2880-18-0x00007FFE86933000-0x00007FFE86935000-memory.dmp
memory/2880-19-0x00007FFE86930000-0x00007FFE873F1000-memory.dmp
memory/2880-20-0x00007FFE86930000-0x00007FFE873F1000-memory.dmp