Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2024 13:37

General

  • Target

    Sigmanly_a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26.exe

  • Size

    577KB

  • MD5

    4153363158f713a02e405d251823c0c3

  • SHA1

    35168f14fa36d3f8d15614cb25a78415015691d1

  • SHA256

    a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26

  • SHA512

    c0bfbb1f13aa7e494369684d74f76deff4390d4910bcabe7bee75caef0eed8a813ef6ea73442cfdb86b6cc0b6a29222d5fcd67a6ed6742eb6eee92c58c83255f

  • SSDEEP

    12288:Om0+u3F55OHTDPJg6i6XGoVnpVn9SIRlwXkMWqsHG6xSd6Ys+tA2Zc:O5FXOPhi6hVn3c0wXkB6IS03+R

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.250:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sigmanly_a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26.exe
    "C:\Users\Admin\AppData\Local\Temp\Sigmanly_a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\Sigmanly_a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26.exe
      "C:\Users\Admin\AppData\Local\Temp\Sigmanly_a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sigmanly_a040d59da6528f88ded3b130199a23f33f01e9b049b89c0cceaabc5c6984bb26.exe.log

    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

  • memory/796-10-0x000000000A4A0000-0x000000000A53C000-memory.dmp

    Filesize

    624KB

  • memory/796-5-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/796-4-0x0000000005750000-0x000000000575A000-memory.dmp

    Filesize

    40KB

  • memory/796-1-0x0000000000B20000-0x0000000000BB6000-memory.dmp

    Filesize

    600KB

  • memory/796-14-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/796-6-0x00000000067C0000-0x00000000067D8000-memory.dmp

    Filesize

    96KB

  • memory/796-7-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

    Filesize

    4KB

  • memory/796-8-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/796-9-0x00000000069C0000-0x0000000006A22000-memory.dmp

    Filesize

    392KB

  • memory/796-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

    Filesize

    4KB

  • memory/796-3-0x0000000005580000-0x0000000005612000-memory.dmp

    Filesize

    584KB

  • memory/796-2-0x0000000005BF0000-0x0000000006194000-memory.dmp

    Filesize

    5.6MB

  • memory/4508-11-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/4508-16-0x0000000005410000-0x0000000005A28000-memory.dmp

    Filesize

    6.1MB

  • memory/4508-15-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/4508-17-0x0000000004D20000-0x0000000004D32000-memory.dmp

    Filesize

    72KB

  • memory/4508-18-0x0000000004DF0000-0x0000000004E2C000-memory.dmp

    Filesize

    240KB

  • memory/4508-20-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB

  • memory/4508-19-0x0000000004D80000-0x0000000004DCC000-memory.dmp

    Filesize

    304KB

  • memory/4508-21-0x0000000005070000-0x000000000517A000-memory.dmp

    Filesize

    1.0MB

  • memory/4508-22-0x0000000074CB0000-0x0000000075460000-memory.dmp

    Filesize

    7.7MB