Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
07/11/2024, 16:17
General
-
Target
65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10.exe
-
Size
292KB
-
MD5
cea5368826643db52889abb3ca7a4304
-
SHA1
d93379ff367aac3979c17a36f72c1bda9adb628c
-
SHA256
65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10
-
SHA512
8873ef1717869a0b7a92f739e8576c69f72694ba62aaf23f34c55243080f2f74ec9ee2d04ad1931a204161001d8c24dbb2a428734d4ea7ccb4d0be2ca4b0a8cb
-
SSDEEP
3072:pY9QSHF8Tkq1H8g03W0c6ZK5ZE+wBXwYDPmIYgpEK5p2zxy2AXur4oXkzxvE57kv:dSHU8g066zGCPYg+K5kzZOoixu+aGD0
Malware Config
Extracted
redline
PUB
45.9.20.20:13441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10.exe"C:\Users\Admin\AppData\Local\Temp\65a9a594ab307fc520a599f3ba1cb81665a09bbb97d0baf1a326b06d5a74cf10.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
204KB
-
Filesize
152KB
-
Filesize
29.4MB
-
Filesize
144KB
-
Filesize
1024KB
-
Filesize
204KB