Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 21:20

General

  • Target

    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe

  • Size

    359KB

  • MD5

    43790b90989995a81538754eafc0e114

  • SHA1

    a64e5c7d636ee5f29961c046e0871e371c5d20ca

  • SHA256

    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc

  • SHA512

    28efcd5f439043e051a5ecfdfc85b25e6425147f63875dcef7cd3f910dd2c797ef2649e85736abca1fc0173f1acdc69ad7261273c9b0a04ebb75020de7e98f20

  • SSDEEP

    6144:ighccEyHTzpA+5DUzYJv35gdma2XvQuoGmEMqkVLSU:ighZEyHfpVgcxp8ma23oGXMNVLd

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.20:13441

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    "C:\Users\Admin\AppData\Local\Temp\bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2880

Network

    No results found
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
  • 45.9.20.20:13441
    bb7db6bca553843768359ac76a31ad1296c33961ceb5e171bd183a51bd4c77cc.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2880-1-0x0000000002CC0000-0x0000000002DC0000-memory.dmp

    Filesize

    1024KB

  • memory/2880-2-0x0000000000220000-0x0000000000250000-memory.dmp

    Filesize

    192KB

  • memory/2880-3-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2880-4-0x0000000004600000-0x0000000004626000-memory.dmp

    Filesize

    152KB

  • memory/2880-5-0x0000000004840000-0x0000000004864000-memory.dmp

    Filesize

    144KB

  • memory/2880-6-0x0000000000400000-0x0000000002BA2000-memory.dmp

    Filesize

    39.6MB

  • memory/2880-7-0x0000000002CC0000-0x0000000002DC0000-memory.dmp

    Filesize

    1024KB

  • memory/2880-8-0x0000000000220000-0x0000000000250000-memory.dmp

    Filesize

    192KB

  • memory/2880-10-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.