Analysis

  • max time kernel
    138s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-08-2024 19:09

General

  • Target

    0cbd1d1fd911909462470b7676d2c275e89dcbf43d20c98a1b73892d19a3c7db.exe

  • Size

    90KB

  • MD5

    0858f53f488185beff71d48ebdb0b62f

  • SHA1

    8a8b00b0239cbfe5b29311f8350e59b964d20d77

  • SHA256

    0cbd1d1fd911909462470b7676d2c275e89dcbf43d20c98a1b73892d19a3c7db

  • SHA512

    e7544a98789798bfbaa04dca9a361cc064de7f07b04335545e11914bc555c0cdba373ab7cee0f7b3af8ccb91d775226f51d8a031dabbd9d2cfd1ddafc37b2720

  • SSDEEP

    1536:qZwHUtM02NgbZ81FFvBqOQzAobnARHfqKxj2yOGdZVxKyEiJk:qZHZ21RDQzAY8yKxqypdZeli2

Malware Config

Extracted

Family

redline

Botnet

@Mandula

C2

45.144.29.212:12850

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cbd1d1fd911909462470b7676d2c275e89dcbf43d20c98a1b73892d19a3c7db.exe
    "C:\Users\Admin\AppData\Local\Temp\0cbd1d1fd911909462470b7676d2c275e89dcbf43d20c98a1b73892d19a3c7db.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2164-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

    Filesize

    4KB

  • memory/2164-1-0x0000000000830000-0x000000000084C000-memory.dmp

    Filesize

    112KB

  • memory/2164-2-0x00000000057E0000-0x0000000005DF8000-memory.dmp

    Filesize

    6.1MB

  • memory/2164-3-0x00000000051E0000-0x00000000051F2000-memory.dmp

    Filesize

    72KB

  • memory/2164-4-0x0000000005240000-0x000000000527C000-memory.dmp

    Filesize

    240KB

  • memory/2164-5-0x0000000005280000-0x00000000052CC000-memory.dmp

    Filesize

    304KB

  • memory/2164-6-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/2164-7-0x0000000005510000-0x000000000561A000-memory.dmp

    Filesize

    1.0MB

  • memory/2164-8-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

    Filesize

    4KB

  • memory/2164-9-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB