redline | bdde06b2f10392b9c34fd2d03dc90c33542f96bdedd67b201dd0c782a1b4bf9b

General

Target

build_2.exe
Size

95KB
MD5

7e2d328e7e2552be4a862e83f9c7177e
SHA1

7d80b8b70676053aaa9d652b721c574ad81b011f
SHA256

bdde06b2f10392b9c34fd2d03dc90c33542f96bdedd67b201dd0c782a1b4bf9b
SHA512

7019d5f9304c380fd6abb609ba78c912dabfc11196a99130ec647678977bf1e00a51bb9062c051620d4c77cb48ebd6c5df4d9fd7f0e13c0e71285d39c2d9cc4d
SSDEEP

1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2t3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdxY

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

95.214.27.27:33806

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1304-54-0x0000000000300000-0x000000000031E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1304-54-0x0000000000300000-0x000000000031E000-memory.dmp	family_sectoprat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ipinfo.io
7 ipinfo.io
8 api.ipify.org
9 api.ipify.org

flow	ioc
6	ipinfo.io
7	ipinfo.io
8	api.ipify.org
9	api.ipify.org

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

build_2.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\92A862854CBECB94F51CD71F036C165CBF654343\Blob = 140000000100000014000000384a5d2bed2b886a7d2286dacc403efb1efce90103000000010000001400000092a862854cbecb94f51cd71f036c165cbf6543430f00000001000000200000000a043e59706f30e9f239884aaf50ab06211f0613bb9e0bac5886fd92654fae012000000001000000f9020000308202f5308201dda003020102021003640d8154647d4bbd57bafeb03febd0300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303832333135303030305a170d3237303832323135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100cd712faf2021aa79a38e90a222d140b84a8b84755762d5c04902f18e27cb243fb60fb0eb11188bf7848b950c4d1e9bfe0264d67d7a3f2bbb6d11fc6c2b981feb4d523f965953261ad93e573205b33a6e032e3e73fa85f5104d44c787cf98575d8bde2fc83801727e17f7b0f94d81befa73fb36ceebdc5fc087eeabcf6f95a88a021bbaef83fa759f4b7e789d0f6ac0268025d6079b3e1b50993de3ad42eb85ce2d94f31328c27dfd1b29e9fb141c3cb6c5c8614d79f1c884eea47a6b26e221052142990f8b44ec224bb1f2f56b9815a967dfb798987f54f8a87931ff207520041f05b219fae3dfff9c12ed5eba0d77d082cdf0ceb1a22ea91a5bb9d0923fabd10203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414384a5d2bed2b886a7d2286dacc403efb1efce901300d06092a864886f70d01010b050003820101002942a3355d3813094d4e4f1bb85f1f95cec9dad805ce011b618ae170c0cde717754f05e24cf931bcb008caccb857ad05db7d23f23931fe8e3ea223a18a6ca72ff33285112751fc432b7a07458feb9f1a6dc6422d84c443ab7bef51f8411d49023cdbf96b699b33bed8397c12bb2c5f424818f31b5ae84fbda9435a52f71b6fe73294af50452c005d5db788e8ad7ee144a4675a3a0d8468699fad17ebffffb4be8fa6f6e15ab18da2d644cedffcb7d210645ff6fcfb9c1bd348ae5d3f452c2e73e11e47f13779f5ea68ef8376b35c8d814f965a3f53c9592b36ca9ea4bccf6acbf5ca6f2e6b97403a441db1aa2e26b5b46c033997dc84116faab4c9d8faac9e07	build_2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\92A862854CBECB94F51CD71F036C165CBF654343\Blob = 19000000010000001000000062ad758a7a5d9f2dff6b04551cc4efa20f00000001000000200000000a043e59706f30e9f239884aaf50ab06211f0613bb9e0bac5886fd92654fae0103000000010000001400000092a862854cbecb94f51cd71f036c165cbf654343140000000100000014000000384a5d2bed2b886a7d2286dacc403efb1efce9012000000001000000f9020000308202f5308201dda003020102021003640d8154647d4bbd57bafeb03febd0300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303832333135303030305a170d3237303832323135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100cd712faf2021aa79a38e90a222d140b84a8b84755762d5c04902f18e27cb243fb60fb0eb11188bf7848b950c4d1e9bfe0264d67d7a3f2bbb6d11fc6c2b981feb4d523f965953261ad93e573205b33a6e032e3e73fa85f5104d44c787cf98575d8bde2fc83801727e17f7b0f94d81befa73fb36ceebdc5fc087eeabcf6f95a88a021bbaef83fa759f4b7e789d0f6ac0268025d6079b3e1b50993de3ad42eb85ce2d94f31328c27dfd1b29e9fb141c3cb6c5c8614d79f1c884eea47a6b26e221052142990f8b44ec224bb1f2f56b9815a967dfb798987f54f8a87931ff207520041f05b219fae3dfff9c12ed5eba0d77d082cdf0ceb1a22ea91a5bb9d0923fabd10203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414384a5d2bed2b886a7d2286dacc403efb1efce901300d06092a864886f70d01010b050003820101002942a3355d3813094d4e4f1bb85f1f95cec9dad805ce011b618ae170c0cde717754f05e24cf931bcb008caccb857ad05db7d23f23931fe8e3ea223a18a6ca72ff33285112751fc432b7a07458feb9f1a6dc6422d84c443ab7bef51f8411d49023cdbf96b699b33bed8397c12bb2c5f424818f31b5ae84fbda9435a52f71b6fe73294af50452c005d5db788e8ad7ee144a4675a3a0d8468699fad17ebffffb4be8fa6f6e15ab18da2d644cedffcb7d210645ff6fcfb9c1bd348ae5d3f452c2e73e11e47f13779f5ea68ef8376b35c8d814f965a3f53c9592b36ca9ea4bccf6acbf5ca6f2e6b97403a441db1aa2e26b5b46c033997dc84116faab4c9d8faac9e07	build_2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\92A862854CBECB94F51CD71F036C165CBF654343	build_2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\92A862854CBECB94F51CD71F036C165CBF654343\Blob = 0f00000001000000200000000a043e59706f30e9f239884aaf50ab06211f0613bb9e0bac5886fd92654fae0103000000010000001400000092a862854cbecb94f51cd71f036c165cbf6543432000000001000000f9020000308202f5308201dda003020102021003640d8154647d4bbd57bafeb03febd0300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3232303832333135303030305a170d3237303832323135303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100cd712faf2021aa79a38e90a222d140b84a8b84755762d5c04902f18e27cb243fb60fb0eb11188bf7848b950c4d1e9bfe0264d67d7a3f2bbb6d11fc6c2b981feb4d523f965953261ad93e573205b33a6e032e3e73fa85f5104d44c787cf98575d8bde2fc83801727e17f7b0f94d81befa73fb36ceebdc5fc087eeabcf6f95a88a021bbaef83fa759f4b7e789d0f6ac0268025d6079b3e1b50993de3ad42eb85ce2d94f31328c27dfd1b29e9fb141c3cb6c5c8614d79f1c884eea47a6b26e221052142990f8b44ec224bb1f2f56b9815a967dfb798987f54f8a87931ff207520041f05b219fae3dfff9c12ed5eba0d77d082cdf0ceb1a22ea91a5bb9d0923fabd10203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414384a5d2bed2b886a7d2286dacc403efb1efce901300d06092a864886f70d01010b050003820101002942a3355d3813094d4e4f1bb85f1f95cec9dad805ce011b618ae170c0cde717754f05e24cf931bcb008caccb857ad05db7d23f23931fe8e3ea223a18a6ca72ff33285112751fc432b7a07458feb9f1a6dc6422d84c443ab7bef51f8411d49023cdbf96b699b33bed8397c12bb2c5f424818f31b5ae84fbda9435a52f71b6fe73294af50452c005d5db788e8ad7ee144a4675a3a0d8468699fad17ebffffb4be8fa6f6e15ab18da2d644cedffcb7d210645ff6fcfb9c1bd348ae5d3f452c2e73e11e47f13779f5ea68ef8376b35c8d814f965a3f53c9592b36ca9ea4bccf6acbf5ca6f2e6b97403a441db1aa2e26b5b46c033997dc84116faab4c9d8faac9e07	build_2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

build_2.exe

pid process

1304 build_2.exe
1304 build_2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

build_2.exe

description pid process

Token: SeDebugPrivilege 1304 build_2.exe

pid	process
1304	build_2.exe
1304	build_2.exe

description	pid	process
Token: SeDebugPrivilege	1304	build_2.exe

C:\Users\Admin\AppData\Local\Temp\build_2.exe
"C:\Users\Admin\AppData\Local\Temp\build_2.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp996E.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp99B3.tmp

Filesize
92KB

MD5
d752b086afe9798d23fb510019fea022

SHA1
98dcda5ef1bd802eafc5b253209b566c6959626c

SHA256
da0d7144608e1f64a45792370e60b770e73fef155ba06478772d30dffaecae99

SHA512
308e8c231f0332425d9c365dbfdccf62869a1962395da92a89058bfc27fae9dba1a396671bc2409455f61a250db4716cec92fd1a6f735911c0945bb73566ff67

Download Submit
memory/1304-54-0x0000000000300000-0x000000000031E000-memory.dmp

Filesize
120KB

Download
memory/1304-55-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download
memory/1304-56-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads