Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 10:56

General

  • Target

    765d2bea3b998e2ac9abc103c79428ddc2b12225ddbf9fcaa5fefac5d1161003.exe

  • Size

    285KB

  • MD5

    a9cfa26773face68ea3491c23a18d8af

  • SHA1

    0d77e0b4e2e9188fb4e34a86141f440d164e3b71

  • SHA256

    765d2bea3b998e2ac9abc103c79428ddc2b12225ddbf9fcaa5fefac5d1161003

  • SHA512

    90020b7be7501b80bde2ff2bebc807dbcf73f30a61f4f0253968906ad78859dd6bbf3257faf3de285a123bfcdff1363eec4f5376093851d94f4f5f8d7ddeb61c

  • SSDEEP

    6144:HLXMpGqVjtZarTGWu2rk2GcJDWDfYybpEXqQ:YIq1D2yWuCXsfR

Malware Config

Extracted

Family

redline

Botnet

PUB

C2

45.9.20.20:13441

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\765d2bea3b998e2ac9abc103c79428ddc2b12225ddbf9fcaa5fefac5d1161003.exe
    "C:\Users\Admin\AppData\Local\Temp\765d2bea3b998e2ac9abc103c79428ddc2b12225ddbf9fcaa5fefac5d1161003.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2432-1-0x00000000021F0000-0x00000000022F0000-memory.dmp

    Filesize

    1024KB

  • memory/2432-2-0x0000000003D70000-0x0000000003DA0000-memory.dmp

    Filesize

    192KB

  • memory/2432-3-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2432-4-0x0000000003F80000-0x0000000003FA6000-memory.dmp

    Filesize

    152KB

  • memory/2432-5-0x0000000006B20000-0x00000000070C4000-memory.dmp

    Filesize

    5.6MB

  • memory/2432-6-0x00000000042D0000-0x00000000042F4000-memory.dmp

    Filesize

    144KB

  • memory/2432-7-0x0000000000400000-0x0000000002165000-memory.dmp

    Filesize

    29.4MB

  • memory/2432-8-0x00000000070D0000-0x00000000076E8000-memory.dmp

    Filesize

    6.1MB

  • memory/2432-9-0x00000000044A0000-0x00000000044B2000-memory.dmp

    Filesize

    72KB

  • memory/2432-10-0x0000000006950000-0x0000000006A5A000-memory.dmp

    Filesize

    1.0MB

  • memory/2432-11-0x00000000044C0000-0x00000000044FC000-memory.dmp

    Filesize

    240KB

  • memory/2432-12-0x0000000006AA0000-0x0000000006AEC000-memory.dmp

    Filesize

    304KB

  • memory/2432-13-0x00000000021F0000-0x00000000022F0000-memory.dmp

    Filesize

    1024KB

  • memory/2432-14-0x0000000003D70000-0x0000000003DA0000-memory.dmp

    Filesize

    192KB

  • memory/2432-16-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB