Analysis

  • max time kernel
    131s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 16:24

General

  • Target

    3026431973056fc89fa7eab69aa1bf0aef6bd0c8a98c4632f9aa63506ae9cd84.exe

  • Size

    161KB

  • MD5

    a62e3bb2d749aa30a89bac5cbd2172e8

  • SHA1

    66973f4ec9e349cf03536123c676981840c2fc7c

  • SHA256

    3026431973056fc89fa7eab69aa1bf0aef6bd0c8a98c4632f9aa63506ae9cd84

  • SHA512

    f3c943b2f179245b929cdac5118a322ba9d09c40575a9f828217be368050658744e020e706c34b30a0ea8486c594b2bb5be2db0a865eeb0f3fba10f900d29ef4

  • SSDEEP

    1536:Zqs8OqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2K3teulgS6p3AvKo:3HuOYj+zi0ZbYe1g0ujyzdMwgg

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

192.168.247.129:37745

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3026431973056fc89fa7eab69aa1bf0aef6bd0c8a98c4632f9aa63506ae9cd84.exe
    "C:\Users\Admin\AppData\Local\Temp\3026431973056fc89fa7eab69aa1bf0aef6bd0c8a98c4632f9aa63506ae9cd84.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1612-0-0x000000007505E000-0x000000007505F000-memory.dmp

    Filesize

    4KB

  • memory/1612-1-0x0000000000070000-0x000000000009E000-memory.dmp

    Filesize

    184KB

  • memory/1612-2-0x0000000005140000-0x0000000005758000-memory.dmp

    Filesize

    6.1MB

  • memory/1612-3-0x0000000004A40000-0x0000000004A52000-memory.dmp

    Filesize

    72KB

  • memory/1612-4-0x0000000004AA0000-0x0000000004ADC000-memory.dmp

    Filesize

    240KB

  • memory/1612-5-0x0000000004B20000-0x0000000004B6C000-memory.dmp

    Filesize

    304KB

  • memory/1612-6-0x0000000075050000-0x0000000075800000-memory.dmp

    Filesize

    7.7MB

  • memory/1612-7-0x0000000004D50000-0x0000000004E5A000-memory.dmp

    Filesize

    1.0MB

  • memory/1612-8-0x000000007505E000-0x000000007505F000-memory.dmp

    Filesize

    4KB

  • memory/1612-9-0x0000000075050000-0x0000000075800000-memory.dmp

    Filesize

    7.7MB