Overview

overview

10

Static

static

3

merged.exe

windows10-2004-x64

10

merged.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/11/2025, 06:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    merged.exe
  • Size 14.9MB
  • Sample251116-g3tmysxpbt
  • SHA256 0386bccb589d71045d34eff814189759773ccda907d6f39ff724b05a22c376a0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
9614discoveryredlinesectopratinfostealerrattrojan

Malware Config

Extracted

Family

  • redline

Botnet

  • 9614

C2

  • 8.tcp.us-cal-1.ngrok.io:18331

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Redline family
    redline
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Sectoprat family
    sectoprat
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\merged.exe
    "C:\Users\Admin\AppData\Local\Temp\merged.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\merged.exe
      "C:\Users\Admin\AppData\Local\Temp\merged.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp6bpr85w0.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Users\Admin\AppData\Local\Temp\tmp6bpr85w0.exe
          C:\Users\Admin\AppData\Local\Temp\tmp6bpr85w0.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3848

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_asyncio.pyd
        • Size 76KB
        • SHA256 bdd004633904171c4d00b84deb69707667b676156840d7869a38edb7ba52d25b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_bz2.pyd
        • Size 85KB
        • SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cffi_backend.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_cffi_backend.cp314-win_amd64.pyd
        • Size 177KB
        • SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_ctypes.pyd
        • Size 138KB
        • SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_decimal.pyd
        • Size 280KB
        • SHA256 a33b1562acc8201411971f54444bd9c648f2d194d9914f0eb734904882213828
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_hashlib.pyd
        • Size 67KB
        • SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_lzma.pyd
        • Size 157KB
        • SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_multiprocessing.pyd
        • Size 37KB
        • SHA256 a8fd9f42314077d35060055f946176ad5753e6bdee9ac175c675d5be8796ea24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_overlapped.pyd
        • Size 56KB
        • SHA256 d08ccd8aa330d52f7793995194f79465a47cc6aab9dcbac017a72cd3c96398f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_queue.pyd
        • Size 35KB
        • SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_socket.pyd
        • Size 85KB
        • SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_ssl.pyd
        • Size 179KB
        • SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_wmi.pyd
        • Size 39KB
        • SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\_zstd.pyd
        • Size 491KB
        • SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\base_library.zip
        • Size 1.3MB
        • SHA256 2011125113d8dff2880c9d36044101c84d357127eb32cf6b75252d39d1302050
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\certifi\cacert.pem
        • Size 277KB
        • SHA256 a1ad5d643e21c43b5bed74c7e0891dcdb58f6af51c8ace1e4f020d654aa52a16
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        md.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\charset_normalizer\md.cp314-win_amd64.pyd
        • Size 10KB
        • SHA256 394271ca355a08eff4e268efef85f3f817bcc7d8661ac655cb47f24132e7eedf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        md__mypyc.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\charset_normalizer\md__mypyc.cp314-win_amd64.pyd
        • Size 120KB
        • SHA256 7d28dad4be5242b16e17e75d94bb1117451754f95c8749aae554caa6973d1c6f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\cryptography\hazmat\bindings\_rust.pyd
        • Size 8.8MB
        • SHA256 92f58bb4f01a75a0ef4dd9425dc2a96ddfe25fc93fd9dc11ea8f0d05b7a4f085
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\pyexpat.pyd
        • Size 211KB
        • SHA256 489ec5678cf44e878ce72a84a9149d67dbe926bdcf8d337ee8fd06b04b3f994b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\python3.DLL
        • Size 72KB
        • SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\python314.dll
        • Size 6.4MB
        • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\select.pyd
        • Size 32KB
        • SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI40922\unicodedata.pyd
        • Size 740KB
        • SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp6bpr85w0.exe
        • Path C:\Users\Admin\AppData\Local\Temp\tmp6bpr85w0.exe
        • Size 95KB
        • SHA256 cd8696a7cdbfe053482ddeefe8a6380803fa89aef12d8490515aa22a9c188f92
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3848-101-0x0000000000150000-0x000000000016E000-memory.dmp
        Download

        memory/3848-102-0x0000000005200000-0x0000000005818000-memory.dmp
        Download

        memory/3848-103-0x0000000004BE0000-0x0000000004BF2000-memory.dmp
        Download

        memory/3848-104-0x0000000004C40000-0x0000000004C7C000-memory.dmp
        Download

        memory/3848-105-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
        Download

        memory/3848-106-0x0000000004C80000-0x0000000004CCC000-memory.dmp
        Download

        memory/3848-107-0x0000000004EE0000-0x0000000004FEA000-memory.dmp
        Download

        memory/3848-108-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
        Download