redline | d0ec43c0885fbe5b2c561762827e365d760bf18c7fb1f01d2eaebfd22b11640f

General

Target

0945f39b0120d145e17eb04a9bfc5205.exe
Size

203KB
MD5

0945f39b0120d145e17eb04a9bfc5205
SHA1

8b6471f8ef6d90eb6f52a819ab2379c83b317d92
SHA256

d0ec43c0885fbe5b2c561762827e365d760bf18c7fb1f01d2eaebfd22b11640f
SHA512

a9b4cc57a4a71ca9e458d944976af755c522780f1a26e4812a0c974e77855e9b19c042f5e0815f7a58707c6e928d96298c89e792a2a8b766f1692e9fcda08bbb
SSDEEP

3072:FHPsopjzJMURetE7WeYz/K80nGEh/hXKmbYcVQqJdOQfl/uHf0T9Ng2iO4iO:VPsot6E7of4GELaIjJdOMlYf0T9NcO

Score

10^/10

redline sectoprat @qu47tr0 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@qu47tr0

C2

45.81.227.32:22625

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 8 IoCs

resource	yara_rule
behavioral1/memory/2092-27-0x0000000000080000-0x000000000009E000-memory.dmp	family_redline
behavioral1/memory/2092-24-0x0000000000080000-0x000000000009E000-memory.dmp	family_redline
behavioral1/memory/2092-20-0x0000000000080000-0x000000000009E000-memory.dmp	family_redline
behavioral1/memory/2092-18-0x0000000000080000-0x000000000009E000-memory.dmp	family_redline
behavioral1/memory/2092-29-0x0000000002380000-0x00000000023C0000-memory.dmp	family_redline
behavioral1/memory/2092-13-0x0000000000080000-0x000000000009E000-memory.dmp	family_redline
behavioral1/memory/2092-11-0x0000000000080000-0x000000000009E000-memory.dmp	family_redline
behavioral1/memory/2092-31-0x0000000002380000-0x00000000023C0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 8 IoCs

resource	yara_rule
behavioral1/memory/2092-27-0x0000000000080000-0x000000000009E000-memory.dmp	family_sectoprat
behavioral1/memory/2092-24-0x0000000000080000-0x000000000009E000-memory.dmp	family_sectoprat
behavioral1/memory/2092-20-0x0000000000080000-0x000000000009E000-memory.dmp	family_sectoprat
behavioral1/memory/2092-18-0x0000000000080000-0x000000000009E000-memory.dmp	family_sectoprat
behavioral1/memory/2092-29-0x0000000002380000-0x00000000023C0000-memory.dmp	family_sectoprat
behavioral1/memory/2092-13-0x0000000000080000-0x000000000009E000-memory.dmp	family_sectoprat
behavioral1/memory/2092-11-0x0000000000080000-0x000000000009E000-memory.dmp	family_sectoprat
behavioral1/memory/2092-31-0x0000000002380000-0x00000000023C0000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	0945f39b0120d145e17eb04a9bfc5205.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17
PID 2112 wrote to memory of 2092	2112	0945f39b0120d145e17eb04a9bfc5205.exe	17

C:\Users\Admin\AppData\Local\Temp\0945f39b0120d145e17eb04a9bfc5205.exe
"C:\Users\Admin\AppData\Local\Temp\0945f39b0120d145e17eb04a9bfc5205.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\0945f39b0120d145e17eb04a9bfc5205.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-27-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-31-0x0000000002380000-0x00000000023C0000-memory.dmp

Filesize
256KB

Download
memory/2092-30-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-7-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-9-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-11-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-24-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-20-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-28-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-13-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-18-0x0000000000080000-0x000000000009E000-memory.dmp

Filesize
120KB

Download
memory/2092-29-0x0000000002380000-0x00000000023C0000-memory.dmp

Filesize
256KB

Download
memory/2112-6-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2112-19-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-1-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-3-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/2112-5-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2112-0-0x0000000000C90000-0x0000000000CCC000-memory.dmp

Filesize
240KB

Download
memory/2112-4-0x00000000003C0000-0x00000000003EE000-memory.dmp

Filesize
184KB

Download
memory/2112-2-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing