Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/11/2024, 04:15
General
-
Target
65af30d4b73e59ff1d9f4e4b4d6307018ca3f204029f35ceb8747c9524cc8b42.exe
-
Size
361KB
-
MD5
133edae3927321531d6603714a6c9ed9
-
SHA1
1e64f4907638e3a2f7f4e001423f87db6e00ebbf
-
SHA256
65af30d4b73e59ff1d9f4e4b4d6307018ca3f204029f35ceb8747c9524cc8b42
-
SHA512
db58b1ea44cd8e0da8dd05d03f7e86de64c6db8f2c926c2b1dfa461c3e387a88e5457696d6dde431335a93f99e1baaedfdd67873961dd58bf88a84113dcf4275
-
SSDEEP
6144:fBmnBSjo/lFC2EK80SDUVv7M+ka2MRkTcm4:fBmnsjo/ltEqZOhaxR2cm
Malware Config
Extracted
redline
UDP
45.9.20.20:13441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\65af30d4b73e59ff1d9f4e4b4d6307018ca3f204029f35ceb8747c9524cc8b42.exe"C:\Users\Admin\AppData\Local\Temp\65af30d4b73e59ff1d9f4e4b4d6307018ca3f204029f35ceb8747c9524cc8b42.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
204KB
-
Filesize
152KB
-
Filesize
39.6MB
-
Filesize
144KB
-
Filesize
39.6MB
-
Filesize
1024KB
-
Filesize
204KB