Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08/11/2024, 01:19
General
-
Target
8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2.exe
-
Size
253KB
-
MD5
b6a9885bf670ce4c771176ed9311c67a
-
SHA1
137f0d5453c126e1d71bb8faf7aa01f00cd26f5d
-
SHA256
8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2
-
SHA512
a68c2813c7a96f9226e773328b406a16b92d1c4f40c3caefdc90e8d10fa5bb93faff4edecc8b35ae90c25c410d106984eee3d05f242d57991dbb4a8280e03a8a
-
SSDEEP
3072:rEfA6SwhhZzQIAP1HgshYpheYmTwztwt1q0aG61Pl+HoyxD6Y6I5hkKg4YS9H6ds:rKzZ0J1Xh4EZLaTCpxD6YhbYEad
Malware Config
Extracted
redline
PUB
45.9.20.20:13441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2.exe"C:\Users\Admin\AppData\Local\Temp\8ce845bb7f5ce8dd6dcc83df87c54d15136e72ae5f252e9c23d67d10d8656be2.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
204KB
-
Filesize
792KB
-
Filesize
152KB
-
Filesize
5.6MB
-
Filesize
144KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
204KB