redline | 98debd3c3f4b58905b927d6da181e996823b9e7a2f38824eef7787649aca1b19

General

Target

0682a9f5123addd86cb7f295c67ab518.exe
Size

260KB
MD5

0682a9f5123addd86cb7f295c67ab518
SHA1

ca32ad01e5fdfeb1b6cba24d1cabf55d6b4c63f1
SHA256

98debd3c3f4b58905b927d6da181e996823b9e7a2f38824eef7787649aca1b19
SHA512

918b9f99640012e6e70083419a631217efe51a50d39e61e547e92b2be1a04badff698630c6bd931e7191465634b6177b2e8be86ce1c75abb67aadaed94ca866b
SSDEEP

6144:nacUZ1tmz14i+fpJjWWEUQGm55yQPYYu/xuXfgi:MZ/HDoR53wYSxIfgi

Score

10^/10

redline sectoprat eu infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

EU

C2

tstamore.info:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1980-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1980-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1980-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1980-11-0x0000000000CE0000-0x0000000000D20000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1980-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1980-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1980-4-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1980-11-0x0000000000CE0000-0x0000000000D20000-memory.dmp	family_sectoprat
behavioral1/memory/1980-13-0x0000000000CE0000-0x0000000000D20000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

0682a9f5123addd86cb7f295c67ab518.exe

description pid process target process

PID 1968 set thread context of 1980 1968 0682a9f5123addd86cb7f295c67ab518.exe 0682a9f5123addd86cb7f295c67ab518.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0682a9f5123addd86cb7f295c67ab518.exe0682a9f5123addd86cb7f295c67ab518.exe

description pid process

Token: SeDebugPrivilege 1968 0682a9f5123addd86cb7f295c67ab518.exe
Token: SeDebugPrivilege 1980 0682a9f5123addd86cb7f295c67ab518.exe

description	pid	process	target process
PID 1968 set thread context of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe

description	pid	process
Token: SeDebugPrivilege	1968	0682a9f5123addd86cb7f295c67ab518.exe
Token: SeDebugPrivilege	1980	0682a9f5123addd86cb7f295c67ab518.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0682a9f5123addd86cb7f295c67ab518.exe

description	pid	process	target process
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe
PID 1968 wrote to memory of 1980	1968	0682a9f5123addd86cb7f295c67ab518.exe	0682a9f5123addd86cb7f295c67ab518.exe

C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe
"C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe
C:\Users\Admin\AppData\Local\Temp\0682a9f5123addd86cb7f295c67ab518.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000D30000-0x0000000000D74000-memory.dmp

Filesize
272KB

Download
memory/1968-1-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1968-2-0x0000000000AF0000-0x0000000000B30000-memory.dmp

Filesize
256KB

Download
memory/1968-3-0x00000000005B0000-0x00000000005D0000-memory.dmp

Filesize
128KB

Download
memory/1968-6-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1980-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1980-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1980-10-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1980-11-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download
memory/1980-12-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-13-0x0000000000CE0000-0x0000000000D20000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads