Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 06:28
General
-
Target
cab862dad410ab2628003fb504c39dbb32d790d5f86eb5a0aade404476396264N.exe
-
Size
1.1MB
-
MD5
dd1f58dfa9b574320cfdbcf9dcdf7e50
-
SHA1
13695c1d58dc8db9616d187b5ab63ae31b540d7e
-
SHA256
cab862dad410ab2628003fb504c39dbb32d790d5f86eb5a0aade404476396264
-
SHA512
16ee8cb70ec344657f8dadf261203490e344b10736b84f3a62e244d8c25c1a0e728277cbc5947c705f7e692b1c2f2c8904d383358f50fc2eee265bcea3c8114e
-
SSDEEP
24576:x5ZWpq5JLimIQTXtUNKcGBZ1ntjaqCkMOHMDmHtjv:x5ZWU5JLimIktUNqB/V3CAMD6
Malware Config
Extracted
redline
123123123
91.214.78.251:32232
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Sectoprat family
-
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab862dad410ab2628003fb504c39dbb32d790d5f86eb5a0aade404476396264N.exe"C:\Users\Admin\AppData\Local\Temp\cab862dad410ab2628003fb504c39dbb32d790d5f86eb5a0aade404476396264N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
1.0MB
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
7.7MB