Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 15:59

General

  • Target

    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe

  • Size

    224KB

  • MD5

    5fad9c7e1fcfe77e79ea61beb29337ae

  • SHA1

    5277e4bc7d14af81ef584337b2cbf2a93dc88d4d

  • SHA256

    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02

  • SHA512

    6c3d9abea7be29ee5b315c4fe5a82b66302799f76c78640b1c8f76744c5eb54b2f7364ed23c47fd0f0670b4ded3f5d07c05603bad0dc827c6b6461aaf28c42ca

  • SSDEEP

    3072:9zRGdzonEWbxTH/fBawdaUoD57N20Xk1YwGzGkA0tl8PcHMSh6k5jqmBlUEe:9zcSEUxTffBxaFtXkNGzGSHMmE+K

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    "C:\Users\Admin\AppData\Local\Temp\c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2416

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    106.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    106.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 45.9.20.20:13441
    c17f4db7a01ad6cb28543ffdfd61699252ed4d2118c660b44b83d00a6b20eb02.exe
    260 B
    5
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    106.209.201.84.in-addr.arpa
    dns
    73 B
    133 B
    1
    1

    DNS Request

    106.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2416-1-0x0000000000670000-0x0000000000770000-memory.dmp

    Filesize

    1024KB

  • memory/2416-2-0x0000000000620000-0x0000000000650000-memory.dmp

    Filesize

    192KB

  • memory/2416-3-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2416-4-0x0000000000400000-0x00000000004BF000-memory.dmp

    Filesize

    764KB

  • memory/2416-5-0x0000000002500000-0x0000000002526000-memory.dmp

    Filesize

    152KB

  • memory/2416-6-0x0000000004C00000-0x00000000051A4000-memory.dmp

    Filesize

    5.6MB

  • memory/2416-7-0x0000000004B90000-0x0000000004BB4000-memory.dmp

    Filesize

    144KB

  • memory/2416-8-0x00000000051B0000-0x00000000057C8000-memory.dmp

    Filesize

    6.1MB

  • memory/2416-9-0x0000000005830000-0x0000000005842000-memory.dmp

    Filesize

    72KB

  • memory/2416-10-0x0000000005850000-0x000000000595A000-memory.dmp

    Filesize

    1.0MB

  • memory/2416-11-0x0000000005960000-0x000000000599C000-memory.dmp

    Filesize

    240KB

  • memory/2416-12-0x00000000059E0000-0x0000000005A2C000-memory.dmp

    Filesize

    304KB

  • memory/2416-13-0x0000000000670000-0x0000000000770000-memory.dmp

    Filesize

    1024KB

  • memory/2416-14-0x0000000000620000-0x0000000000650000-memory.dmp

    Filesize

    192KB

  • memory/2416-16-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.