redline | 48392d598ded71e4b8002411d71b87f53eaeeabcc5d636b263df06c22eaeb172

General

Target

0fd4cc35d4545f34e4a14926800ce567.exe
Size

1.0MB
MD5

0fd4cc35d4545f34e4a14926800ce567
SHA1

4b78839b0610c4088f43fbc832f421ad737bd00b
SHA256

48392d598ded71e4b8002411d71b87f53eaeeabcc5d636b263df06c22eaeb172
SHA512

6396598ab1186cec46be1e0402e042bea099294bf9af8b2d32c557eb90562939d3a8df3617e80b7f745ad73246af29c5c224dbcb0bf30092b2b9a3af49e0b986
SSDEEP

12288:GU0NTISdQG8MgUhtTTCB3CHflOEspJpmrlP2BAZy2+misUC5VceGcSvvpQeEBGWT:GU6TIExdTnk5pJkxOo8snpSdEBPT

Score

10^/10

redline sectoprat mastif infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

mastif

C2

185.81.114.75:58642

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/872-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/872-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/872-21-0x00000000047B0000-0x00000000047F0000-memory.dmp	family_redline
behavioral1/memory/872-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/872-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/872-10-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/872-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/872-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/872-21-0x00000000047B0000-0x00000000047F0000-memory.dmp	family_sectoprat
behavioral1/memory/872-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/872-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/872-10-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

0fd4cc35d4545f34e4a14926800ce567.exe

description pid process target process

PID 1220 set thread context of 872 1220 0fd4cc35d4545f34e4a14926800ce567.exe 0fd4cc35d4545f34e4a14926800ce567.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0fd4cc35d4545f34e4a14926800ce567.exe0fd4cc35d4545f34e4a14926800ce567.exe

description pid process

Token: SeDebugPrivilege 1220 0fd4cc35d4545f34e4a14926800ce567.exe
Token: SeDebugPrivilege 872 0fd4cc35d4545f34e4a14926800ce567.exe

description	pid	process	target process
PID 1220 set thread context of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe

description	pid	process
Token: SeDebugPrivilege	1220	0fd4cc35d4545f34e4a14926800ce567.exe
Token: SeDebugPrivilege	872	0fd4cc35d4545f34e4a14926800ce567.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0fd4cc35d4545f34e4a14926800ce567.exe

description	pid	process	target process
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe
PID 1220 wrote to memory of 872	1220	0fd4cc35d4545f34e4a14926800ce567.exe	0fd4cc35d4545f34e4a14926800ce567.exe

C:\Users\Admin\AppData\Local\Temp\0fd4cc35d4545f34e4a14926800ce567.exe
"C:\Users\Admin\AppData\Local\Temp\0fd4cc35d4545f34e4a14926800ce567.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\0fd4cc35d4545f34e4a14926800ce567.exe
"C:\Users\Admin\AppData\Local\Temp\0fd4cc35d4545f34e4a14926800ce567.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-20-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/872-21-0x00000000047B0000-0x00000000047F0000-memory.dmp

Filesize
256KB

Download
memory/872-23-0x00000000047B0000-0x00000000047F0000-memory.dmp

Filesize
256KB

Download
memory/872-22-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/872-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/872-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1220-6-0x0000000005ED0000-0x0000000005F3A000-memory.dmp

Filesize
424KB

Download
memory/1220-3-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/1220-4-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1220-1-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/1220-2-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/1220-0-0x0000000000A10000-0x0000000000B16000-memory.dmp

Filesize
1.0MB

Download
memory/1220-7-0x0000000000950000-0x0000000000974000-memory.dmp

Filesize
144KB

Download
memory/1220-5-0x0000000000510000-0x0000000000546000-memory.dmp

Filesize
216KB

Download
memory/1220-16-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads