redline | c81ccfef5ce97e9647b89a79b4adbdb73feceea4c8ed0fa88b33f02e52859b8f

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0602d74b76caa2200b12f83c8a77b617.exe
Size 1.1MB
Sample231229-2prawsgfaq
SHA256 c81ccfef5ce97e9647b89a79b4adbdb73feceea4c8ed0fa88b33f02e52859b8f
MD5 0602d74b76caa2200b12f83c8a77b617
SHA1 d9b6aea303abac942f632459349a361cae9fa9a3
SHA512 e61268383629af097e3e7102ef917ea6355a3e16a33d46d1128b780d203fd6511d7f1f9ca977353eef64aa7c1cd7f32a133a1c04775176cae2f33f0ed16b35f7
SSDEEP 24576:O7WVBJ21Phu7NbcPEipoZDO7yeLa0kKA+Br/PWkZTRMA:IGFqEi2Za7/Lx3p/+SB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat infostealer rat trojan

Malware Config

Extracted

Family

redline

zimasaueta.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2824-25-0x00000000005C0000-0x00000000005DE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2824-25-0x00000000005C0000-0x00000000005DE000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	0602d74b76caa2200b12f83c8a77b617.exe

Executes dropped EXE 3 IoCs

pid	Process
3772	Scegliendo.exe.com
4864	Scegliendo.exe.com
2824	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 2824	4864	Scegliendo.exe.com	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4680	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 5048	4272	0602d74b76caa2200b12f83c8a77b617.exe	52
PID 4272 wrote to memory of 5048	4272	0602d74b76caa2200b12f83c8a77b617.exe	52
PID 4272 wrote to memory of 5048	4272	0602d74b76caa2200b12f83c8a77b617.exe	52
PID 5048 wrote to memory of 5016	5048	cmd.exe	54
PID 5048 wrote to memory of 5016	5048	cmd.exe	54
PID 5048 wrote to memory of 5016	5048	cmd.exe	54
PID 5016 wrote to memory of 2620	5016	cmd.exe	55
PID 5016 wrote to memory of 2620	5016	cmd.exe	55
PID 5016 wrote to memory of 2620	5016	cmd.exe	55
PID 5016 wrote to memory of 3772	5016	cmd.exe	94
PID 5016 wrote to memory of 3772	5016	cmd.exe	94
PID 5016 wrote to memory of 3772	5016	cmd.exe	94
PID 5016 wrote to memory of 4680	5016	cmd.exe	95
PID 5016 wrote to memory of 4680	5016	cmd.exe	95
PID 5016 wrote to memory of 4680	5016	cmd.exe	95
PID 3772 wrote to memory of 4864	3772	Scegliendo.exe.com	96
PID 3772 wrote to memory of 4864	3772	Scegliendo.exe.com	96
PID 3772 wrote to memory of 4864	3772	Scegliendo.exe.com	96
PID 4864 wrote to memory of 2824	4864	Scegliendo.exe.com	107
PID 4864 wrote to memory of 2824	4864	Scegliendo.exe.com	107
PID 4864 wrote to memory of 2824	4864	Scegliendo.exe.com	107
PID 4864 wrote to memory of 2824	4864	Scegliendo.exe.com	107
PID 4864 wrote to memory of 2824	4864	Scegliendo.exe.com	107

C:\Users\Admin\AppData\Local\Temp\0602d74b76caa2200b12f83c8a77b617.exe
"C:\Users\Admin\AppData\Local\Temp\0602d74b76caa2200b12f83c8a77b617.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Vedrei.jar
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^TvDNxkTHNPhDVtbGlizRibXOirOUSPkjlRfWzTaCXCCWENaFQfomEzKcmOGsbZPYEwarOAhdPQUFUqpzLotCGLHRiTvEhwyYNEaCcgQfeSKNmyAmEjFfVjaSzAWUtIeOLVRdHHYvsOA$" Chiamando.jar
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com
      Scegliendo.exe.com r
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com r
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
  - - C:\Windows\SysWOW64\PING.EXE
      ping IMXSDNYJ -n 30
      4⤵
      Runs ping.exe
      PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Arresti.jar

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Arresti.jar
Size 98KB
SHA256 5a2c1f7f5a6c64784447973dfaf21cfe4ccde201d5ec6b9aa66b4d9601bebbe6
MD5 4fcc7fd0fa24067fea13540a126fd395
SHA1 8c09cc2a7e57c6722ad2c03dc76a20c7efeca71e
SHA512 66b99782bdcaf99be57a2f3be148aa87153c9b394b74b9bcf5a8c3c10c91e92d7f571a23656732b4c1a3c7cd5053eb1ff71e34380439b831702c6a21b533d5fc
SSDEEP 3072:NMZGuWWycJAQbVlyLeebxZJQe18KXP2gZ3:NyVycuQRm1ieR/26
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chiamando.jar

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Chiamando.jar
Size 50KB
SHA256 dce031b464ce912020be83ddf04106f4796726c3f7a7b01a73c7aad95b4fc524
MD5 28c2d8c460f34fa264655c29fdb92a05
SHA1 ef6ff7d8573b96b33b8b8fee1da373625a9b0a96
SHA512 40b9841326a58e56442d44347d2e800f819659d0e9f77ed4866d5e57f5bc20ac71ccd781e9a94704a081b5451f63cf115a5f8d054440f8d103039e9f74227368
SSDEEP 768:IcH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCV5mhzw4NKCFOsQW+Bfm4u:IPCV21YEsmnq7Cv/+/Coc5m+4Xf8O46l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dalla.jar

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dalla.jar
Size 71KB
SHA256 c677cfbddcfaaf71ed34881236199d5ced5fd6b0be6329575a448f3c1d730605
MD5 c98cccc28e54cacff773bcbea1b23b7e
SHA1 5158df09b096a7c221ca0b0b1555513176e86143
SHA512 7293cae9de7a65c8b3ce2e1627f86e4dd7de6654a609f8d157c0b3d4c7cc0ad1e2370141de27017488644187a2cdb6d7ba67b840d4db94c064e6274e28bb9f65
SSDEEP 768:1E4olGFSig+0WR6HlQw/rdESfVSw+Xx8b8qu7VPldU6WYNIVYxp5Ssacp4U/KEUL:1+6JROSlqaJIVZcSXatG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
Size 63KB
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scegliendo.exe.com

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com
Size 188KB
SHA256 189509eee125bdaaecf81853e136b45666b679cd923ee3c2149ba6d02a78f8dc
MD5 80cc1d40f4a39ea5de5e2387f0d543f6
SHA1 bb3927f0a2e4e58c88f8814eda832f6aea0bfbe8
SHA512 0b65a16d0b1709a8edaf3853da33ac2f750cb5ffe70ad428bf314e5c9688747e9c0b3e527db2d4a920605ebe308f1ed2f35f1865ec5f669d23b7cb84cda45593
SSDEEP 3072:6CV26MqgQTc5F446iYNpK5SB7BJBzLZDKJtIs8di/37O:6i2VWTyFsJ8gNJBnGtI5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scegliendo.exe.com

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com
Size 190KB
SHA256 9d23d7c9e51ed276666cec228814cf69733acb187634a3ba562e67fdcd95c3bd
MD5 02f419b2590b42ab3d4585959f67f96e
SHA1 f60a6e6c0043e50aec4c6ce7ececc73c9bceda70
SHA512 d057591590fab943352198f53792d748ae162030b0fcf708d9a40b20fb91346965bca25a78a5ba3857dd8f0beabf852c52e57e01583f6e7e8f733e3ff06f4648
SSDEEP 3072:6CV26MqgQTc5F446iYNpK5SB7BJBzLZDKJtIs8di/37M:6i2VWTyFsJ8gNJBnGtIB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scegliendo.exe.com

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Scegliendo.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vedrei.jar

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Vedrei.jar
Size 477B
SHA256 e4cd6eb333a68b0ea5ebbc79d0121d5e39e54f7d03599e4b6e31ba689207a2e1
MD5 d0d673393a31cd9468ae0fd4bf9cba99
SHA1 c089b4d67b348af91ad0ef734c2c82b10dea4a52
SHA512 101e3a30ccded26efc75faaef908701ba199d6f0536f3a9ceae51102e0c34dada831bd908e0fb3cb5ae593b2c9b6270ac4ae695164cce53a409b0de69c83b050
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\r
Size 154KB
SHA256 3f5628ee6f2db234780c53061ec20a8cdffde45ecde5d80bda543b38014e65a6
MD5 ad49e49e573048da797590e1a362c915
SHA1 7b4afa9e55254268c546b8c525d29bd039956c68
SHA512 3e7485555761e23e07359a60cdffd2ef4d56551ba61c7c3a28a1fa54b4d56c28ce8850ca49228702838438169d7f235561922cd90cc7a1123657e8d10d62ef7a
SSDEEP 1536:1+6JROSlqaJIVZcSXatX5RC+vx2nXh0Aos0U+bJqEbgW:o6JR3lqaJIrVoCOx2nXh0AoDjqEbgW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2824-30-0x00000000051A0000-0x00000000057B8000-memory.dmp

Download

memory/2824-25-0x00000000005C0000-0x00000000005DE000-memory.dmp

Download

memory/2824-29-0x0000000073720000-0x0000000073ED0000-memory.dmp

Download

memory/2824-31-0x0000000004BA0000-0x0000000004BB2000-memory.dmp

Download

memory/2824-32-0x0000000004C40000-0x0000000004C7C000-memory.dmp

Download

memory/2824-33-0x0000000004C80000-0x0000000004CCC000-memory.dmp

Download

memory/2824-34-0x0000000004F60000-0x000000000506A000-memory.dmp

Download

memory/2824-35-0x0000000073720000-0x0000000073ED0000-memory.dmp

Download

memory/4864-23-0x0000000001610000-0x0000000001611000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads