Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/11/2024, 09:24
General
-
Target
4e658ab23f0d406644c7deea66f3ac91b24e0855ba18c266071c14084e437dc7.exe
-
Size
400KB
-
MD5
5dc2b0f21c19f479233f4e20f877c8c0
-
SHA1
f0f81fb247fbeb268ae7937c5a75f7281689ce50
-
SHA256
4e658ab23f0d406644c7deea66f3ac91b24e0855ba18c266071c14084e437dc7
-
SHA512
0318b5305e0bb16c2032749381ed74b4822819a1f00afaed551ef4f57c635bf3e6a5c57efa5540b836a2c689ba38d4a7d600dd5969339fa51eae42003f3a41c2
-
SSDEEP
6144:PibViS9GgZ/yTjWXxKCdR9uFN0s7PMzkAgpNWJZHfcUS29bc4CFIcN:WVBPK/WXn9u/0s7ekAgzWXVS2Yic
Malware Config
Extracted
redline
185.215.113.29:8678
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e658ab23f0d406644c7deea66f3ac91b24e0855ba18c266071c14084e437dc7.exe"C:\Users\Admin\AppData\Local\Temp\4e658ab23f0d406644c7deea66f3ac91b24e0855ba18c266071c14084e437dc7.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
204KB
-
Filesize
19.6MB
-
Filesize
144KB
-
Filesize
136KB
-
Filesize
1024KB