Analysis

  • max time kernel
    132s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2024 19:37

General

  • Target

    RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe

  • Size

    165KB

  • MD5

    be0f22a9ca20cf368fbd17e5afd29b75

  • SHA1

    0d4b2f8be1ad496961a0baf3210d074f471f3817

  • SHA256

    988ad96cba3b6d7aeb50c3c1c83e9abfc05e7bad5ae0e58d7d93ae55369e7a29

  • SHA512

    1f0f44173bf9d67d112fa2e1bdfcf7544027eb2c6df2a94c1e4f8559a8074d4435805888948eda011c7377372d68552ec65418c8de0f29cf2ee489cb1f223416

  • SSDEEP

    1536:FHtTzHtyfEpZeTHfFH1DCZ4ZjHSxANkKTeWC5HlhX/BQGOLPT:xtnhpYL51DpqANkKTeWC5HlhvilLL

Malware Config

Extracted

Family

redline

Botnet

lovato

C2

57.128.132.216:55123

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388\RFQ-Al NASR-00388.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388\RFQ-Al NASR-00388.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4940
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
        PID:4064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4940-0-0x00000000753AE000-0x00000000753AF000-memory.dmp

      Filesize

      4KB

    • memory/4940-1-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/4940-2-0x0000000005730000-0x0000000005D48000-memory.dmp

      Filesize

      6.1MB

    • memory/4940-3-0x0000000004F40000-0x0000000004F52000-memory.dmp

      Filesize

      72KB

    • memory/4940-4-0x0000000004FA0000-0x0000000004FDC000-memory.dmp

      Filesize

      240KB

    • memory/4940-5-0x0000000004FE0000-0x000000000502C000-memory.dmp

      Filesize

      304KB

    • memory/4940-6-0x00000000753A0000-0x0000000075B50000-memory.dmp

      Filesize

      7.7MB

    • memory/4940-7-0x0000000005220000-0x000000000532A000-memory.dmp

      Filesize

      1.0MB

    • memory/4940-8-0x00000000753AE000-0x00000000753AF000-memory.dmp

      Filesize

      4KB

    • memory/4940-9-0x00000000753A0000-0x0000000075B50000-memory.dmp

      Filesize

      7.7MB