Analysis

  • max time kernel
    140s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 15:53

General

  • Target

    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe

  • Size

    317KB

  • MD5

    1beb3bf1a30660549752bfc6173b9cbd

  • SHA1

    62679c03fdebb32a4525d8ab1315cad1f0269eb9

  • SHA256

    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66

  • SHA512

    9b2eac74bd8b1b2b309e7eeab10b01b6458f464b6abe7e0494719d8129d6775f850d10294d5e31f822896dce6f157679e45cc8860e7449d36c280f8bd0d3c3ae

  • SSDEEP

    6144:wCZQpuCn0CzqU7qX7nQbV8Zme/WdMNKxz0LOsxKpX3PfSgh:dZ4n0CzqUWDQb6oc2MvxS3Sg

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    "C:\Users\Admin\AppData\Local\Temp\7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:384

Network

  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    75.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.117.19.2.in-addr.arpa
    IN PTR
    Response
    75.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-75deploystaticakamaitechnologiescom
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 45.9.20.20:13441
    7c97f0deaa47de819fab1ddd525858b40cd57d6c8c81bb757884d9e446414c66.exe
    260 B
    5
  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    67.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    67.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    146 B
    144 B
    2
    1

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    75.117.19.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    75.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/384-2-0x0000000000570000-0x00000000005A0000-memory.dmp

    Filesize

    192KB

  • memory/384-1-0x00000000007E0000-0x00000000008E0000-memory.dmp

    Filesize

    1024KB

  • memory/384-3-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/384-4-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/384-5-0x0000000000C70000-0x0000000000C96000-memory.dmp

    Filesize

    152KB

  • memory/384-6-0x0000000004D00000-0x00000000052A4000-memory.dmp

    Filesize

    5.6MB

  • memory/384-7-0x0000000002570000-0x0000000002594000-memory.dmp

    Filesize

    144KB

  • memory/384-8-0x00000000052B0000-0x00000000058C8000-memory.dmp

    Filesize

    6.1MB

  • memory/384-9-0x0000000004BF0000-0x0000000004C02000-memory.dmp

    Filesize

    72KB

  • memory/384-10-0x00000000058D0000-0x00000000059DA000-memory.dmp

    Filesize

    1.0MB

  • memory/384-11-0x0000000004C10000-0x0000000004C4C000-memory.dmp

    Filesize

    240KB

  • memory/384-12-0x0000000004C90000-0x0000000004CDC000-memory.dmp

    Filesize

    304KB

  • memory/384-13-0x00000000007E0000-0x00000000008E0000-memory.dmp

    Filesize

    1024KB

  • memory/384-14-0x0000000000570000-0x00000000005A0000-memory.dmp

    Filesize

    192KB

  • memory/384-15-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.