redline | e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5d2a7d53aeeac4f0812340e159d8c66.exe
Size

755KB
MD5

a5d2a7d53aeeac4f0812340e159d8c66
SHA1

5f1f46a6a557656ca04f562c07f2cb7084c6b094
SHA256

e481b0400f271dce93ba7691e428c233f4f5e5744c7b276675fde5aee14e75c9
SHA512

0a6df7c1dc7b68574249b1c878c0be8ebe2ee3cd9161dff385139f33ec1ba54f07b0af3a6f426040926771060c5393aec177ad247ba5d46401a549fc9c8423f4
SSDEEP

12288:U9UPHFtND4ZIrsHWihcF4JJTnJQZgplDliDDmNGkMAJIJ6zcRSdiuVHJ/R/++Bm0:U9qFtp6xWFkJ2ZSDYDc9MAJdPV7+ymFm

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

45.137.22.116:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1436-41-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1436-42-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1436-45-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1436-50-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1436-48-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/1436-41-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1436-42-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1436-45-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1436-50-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1436-48-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/3008-55-0x00000000025E0000-0x0000000002620000-memory.dmp	family_sectoprat

Executes dropped EXE 2 IoCs

pid	Process
2780	PO.exe
1436	PO.exe

Loads dropped DLL 5 IoCs

pid	Process
1992	a5d2a7d53aeeac4f0812340e159d8c66.exe
1992	a5d2a7d53aeeac4f0812340e159d8c66.exe
1992	a5d2a7d53aeeac4f0812340e159d8c66.exe
1992	a5d2a7d53aeeac4f0812340e159d8c66.exe
2780	PO.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 1436	2780	PO.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3008	powershell.exe
1436	PO.exe
1436	PO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	PO.exe
Token: SeDebugPrivilege	3008	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1360	DllHost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2780	1992	a5d2a7d53aeeac4f0812340e159d8c66.exe	29
PID 1992 wrote to memory of 2780	1992	a5d2a7d53aeeac4f0812340e159d8c66.exe	29
PID 1992 wrote to memory of 2780	1992	a5d2a7d53aeeac4f0812340e159d8c66.exe	29
PID 1992 wrote to memory of 2780	1992	a5d2a7d53aeeac4f0812340e159d8c66.exe	29
PID 2780 wrote to memory of 3008	2780	PO.exe	32
PID 2780 wrote to memory of 3008	2780	PO.exe	32
PID 2780 wrote to memory of 3008	2780	PO.exe	32
PID 2780 wrote to memory of 3008	2780	PO.exe	32
PID 2780 wrote to memory of 2424	2780	PO.exe	34
PID 2780 wrote to memory of 2424	2780	PO.exe	34
PID 2780 wrote to memory of 2424	2780	PO.exe	34
PID 2780 wrote to memory of 2424	2780	PO.exe	34
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36
PID 2780 wrote to memory of 1436	2780	PO.exe	36

C:\Users\Admin\AppData\Local\Temp\a5d2a7d53aeeac4f0812340e159d8c66.exe
"C:\Users\Admin\AppData\Local\Temp\a5d2a7d53aeeac4f0812340e159d8c66.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uWOFfhD.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uWOFfhD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5CD.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1436

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA40.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpg

Filesize
83KB

MD5
016025125f3b479aaabf8a4246073856

SHA1
123cf64214f2ba96dedc076d388ddf60d2ec5ce5

SHA256
39f3195908d56ee6d4d0f6484c913bbb268e934121856c590b397bbf7a3573ca

SHA512
4c83f010593e2ec86de367653a0c03aad7a41d1a7f6e26e302666ee81b6f4f4841e3395a026856e35ba9d092ef530af0756b4adb13e944dd7a0d5d5b64ddc62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA81.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1527.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp154D.tmp

Filesize
92KB

MD5
5f358a4b656915069dae00d3580004a1

SHA1
c81e8b6f220818370d47464210c07f0148e36049

SHA256
8917aa7c60dc0d81231fb4be80a0d7b0e934ea298fb486c4bad66ef77bebcf5a

SHA512
d63ebd45d31f596a5c8f4fcc816359a24cbf2d060cb6e6a7648abaf14dc7cf76dda3721c9d19cb7e84eaeb113a3ee1f7be44b743f929de05c66da49c7ba7e97d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5CD.tmp

Filesize
1KB

MD5
ff3974ec711230dacd8ae8073ba6eb90

SHA1
45e2d78574350998a1b2b9b50ba53b0f897f624c

SHA256
8eeae62023facd2bfca115b40a9944f64358b8ca9b9934867d4cfe6e2c414ba5

SHA512
08f76d6f1f10781810b4c89f6a79fa324a7207efce2ab5c51a5d1fd19145600c397f0f48800a835225a47a74d3e892e76f31c2c572b7ebf271e4599c011aa523

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe

Filesize
497KB

MD5
12c97a400062791db05e2f6324e648f8

SHA1
78cc96b66da815798467328126bbcb4c4cf4ea3b

SHA256
d8083d331cddb08e3ca86bb6191d172e1a10bba6c621c0775f6f66b3dff7c0b3

SHA512
92e3023e7bd592f92e9124fc34d368b708c816460a348544686a75f3bf6e080b9b560469417a80100f4981d7e1812058774d967610e33ea4f3e22952e5e35bdf

Download Submit
memory/1360-5-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download
memory/1360-26-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1360-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1436-58-0x0000000073490000-0x0000000073B7E000-memory.dmp

Filesize
6.9MB

Download
memory/1436-42-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-54-0x0000000073490000-0x0000000073B7E000-memory.dmp

Filesize
6.9MB

Download
memory/1436-56-0x0000000004B70000-0x0000000004BB0000-memory.dmp

Filesize
256KB

Download
memory/1436-39-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-40-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-41-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-66-0x0000000004B70000-0x0000000004BB0000-memory.dmp

Filesize
256KB

Download
memory/1436-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1436-175-0x0000000073490000-0x0000000073B7E000-memory.dmp

Filesize
6.9MB

Download
memory/1436-45-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-50-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-48-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1992-4-0x0000000000DD0000-0x0000000000DD2000-memory.dmp

Filesize
8KB

Download
memory/2780-22-0x0000000000910000-0x0000000000992000-memory.dmp

Filesize
520KB

Download
memory/2780-52-0x0000000073490000-0x0000000073B7E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-30-0x00000000021C0000-0x0000000002218000-memory.dmp

Filesize
352KB

Download
memory/2780-29-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/2780-28-0x0000000004650000-0x0000000004690000-memory.dmp

Filesize
256KB

Download
memory/2780-27-0x0000000073490000-0x0000000073B7E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-25-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/2780-24-0x0000000004650000-0x0000000004690000-memory.dmp

Filesize
256KB

Download
memory/2780-21-0x0000000073490000-0x0000000073B7E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-53-0x000000006E300000-0x000000006E8AB000-memory.dmp

Filesize
5.7MB

Download
memory/3008-55-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/3008-51-0x000000006E300000-0x000000006E8AB000-memory.dmp

Filesize
5.7MB

Download
memory/3008-57-0x000000006E300000-0x000000006E8AB000-memory.dmp

Filesize
5.7MB

Download