redline | 055e57a625038b3082161f3e2148a5fafc6f767298cd9ae67f5c1cac9ab71dad

General

Target

ElectronicDepositCopypdf.exe
Size

1.8MB
MD5

f252f506f84914c3886e791dc984c9e0
SHA1

62dab96df46604f04cd14ee24f27e32840809722
SHA256

055e57a625038b3082161f3e2148a5fafc6f767298cd9ae67f5c1cac9ab71dad
SHA512

90ae68bfb3ceacd5fa86ed784f3f3ea5f809b703ac35e041adb336eb813bef953421b36b6e7ad77b5c3b2d7a21dd5f975f3c4891a17d7fd1502c60320d73ccb6
SSDEEP

6144:cG5aR292nLhb3ZDcJbmiRBAOb9W4YbPg02ytpRlt:vaR2knLhJWBvWxMFAXlt

Score

10^/10

redline sectoprat 4 infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

4

C2

147.124.217.33:22650

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1716-133-0x0000000000500000-0x000000000051E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1716-133-0x0000000000500000-0x000000000051E000-memory.dmp	family_sectoprat

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1268 set thread context of 1716	1268	ElectronicDepositCopypdf.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1268	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	RegSvcs.exe
1716	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	RegSvcs.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1716	1268	ElectronicDepositCopypdf.exe	84
PID 1268 wrote to memory of 1716	1268	ElectronicDepositCopypdf.exe	84
PID 1268 wrote to memory of 1716	1268	ElectronicDepositCopypdf.exe	84
PID 1268 wrote to memory of 1716	1268	ElectronicDepositCopypdf.exe	84
PID 1268 wrote to memory of 1716	1268	ElectronicDepositCopypdf.exe	84

C:\Users\Admin\AppData\Local\Temp\ElectronicDepositCopypdf.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronicDepositCopypdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 144
  2⤵
  - Program crash
  PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1268 -ip 1268
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB3B1.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB3D6.tmp

Filesize
92KB

MD5
c9f27e93d4d2fb6dc5d4d1d2f7d529db

SHA1
cc44dd47cabe4d2ebba14361f8b5254064d365d3

SHA256
d724f78d92cc963b4a06a12a310c0f5411b1ce42361dcfc498a5759efe9fdd7c

SHA512
f7cc478278a5725e18ac8c7ff715fd88798b4562412d354925711c25353277ff2044d3c4a314d76f987006941b35cdde43deb9df4397b37689f67cb8fe541472

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB411.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB427.tmp

Filesize
112KB

MD5
780853cddeaee8de70f28a4b255a600b

SHA1
ad7a5da33f7ad12946153c497e990720b09005ed

SHA256
1055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3

SHA512
e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB462.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
memory/1716-145-0x0000000006150000-0x00000000061E2000-memory.dmp

Filesize
584KB

Download
memory/1716-149-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1716-144-0x0000000006680000-0x0000000006BAC000-memory.dmp

Filesize
5.2MB

Download
memory/1716-133-0x0000000000500000-0x000000000051E000-memory.dmp

Filesize
120KB

Download
memory/1716-146-0x00000000061F0000-0x0000000006266000-memory.dmp

Filesize
472KB

Download
memory/1716-147-0x0000000007160000-0x0000000007704000-memory.dmp

Filesize
5.6MB

Download
memory/1716-148-0x0000000006540000-0x000000000655E000-memory.dmp

Filesize
120KB

Download
memory/1716-143-0x0000000005F80000-0x0000000006142000-memory.dmp

Filesize
1.8MB

Download
memory/1716-150-0x0000000007040000-0x00000000070A6000-memory.dmp

Filesize
408KB

Download
memory/1716-142-0x0000000004DD0000-0x0000000004EDA000-memory.dmp

Filesize
1.0MB

Download
memory/1716-141-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1716-140-0x0000000004B10000-0x0000000004B4C000-memory.dmp

Filesize
240KB

Download
memory/1716-139-0x0000000004AB0000-0x0000000004AC2000-memory.dmp

Filesize
72KB

Download
memory/1716-138-0x0000000005210000-0x0000000005828000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing