Analysis

  • max time kernel
    115s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 21:24

General

  • Target

    dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d.exe

  • Size

    768KB

  • MD5

    37574421be2ebdf28616c62bfc29aa50

  • SHA1

    4c65300a68a19e2a9b58048517e5764fd6ed76fb

  • SHA256

    dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d

  • SHA512

    f2a0c5e6288434e79f01df236f6554360dc43521bad726b222a0b242271c4fe4997f13c994ad663eb76283ca361105460ce086c9df488aefb6b1d09e53f16b41

  • SSDEEP

    12288:1paoy89TKFdcgviDi01Of+xLsdG2pjiTxUlJ8LEKShOMyMryAU9XdHTSczcBFkHF:1UzRb7W+hJ0r8yM9wdzSczcBFkHF

Malware Config

Extracted

Family

redline

Botnet

@Durak9876

C2

95.181.152.5:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d.exe
    "C:\Users\Admin\AppData\Local\Temp\dd25905bdd3a29daf6515c3ce51155f08ab303b50a95196c0877c016f63a184d.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4892-0-0x0000000000C80000-0x0000000000CB1000-memory.dmp

    Filesize

    196KB

  • memory/4892-7-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

  • memory/4892-8-0x0000000002680000-0x00000000026A2000-memory.dmp

    Filesize

    136KB

  • memory/4892-9-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4892-10-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4892-11-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4892-12-0x0000000005320000-0x0000000005938000-memory.dmp

    Filesize

    6.1MB

  • memory/4892-13-0x00000000052F0000-0x0000000005302000-memory.dmp

    Filesize

    72KB

  • memory/4892-14-0x0000000005980000-0x0000000005A8A000-memory.dmp

    Filesize

    1.0MB

  • memory/4892-15-0x0000000005A90000-0x0000000005ACC000-memory.dmp

    Filesize

    240KB

  • memory/4892-16-0x0000000005B10000-0x0000000005B5C000-memory.dmp

    Filesize

    304KB

  • memory/4892-17-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4892-18-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

  • memory/4892-19-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

  • memory/4892-20-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/4892-21-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB