redline | 752cc244ad2a7d0e4fa6128304df14ecedaad840a641384546ec292f123619ab

General

Target

6e10a6fbc11e4be9196d2218660c3073.exe
Size

209KB
MD5

6e10a6fbc11e4be9196d2218660c3073
SHA1

47a2ebb192d54701d2ac1e9b76911baa31eb2972
SHA256

752cc244ad2a7d0e4fa6128304df14ecedaad840a641384546ec292f123619ab
SHA512

2d53ad9e9e543749edd3309e3f03dd3c05c67662d86aa5875875e28c03bba0e5f724ea443ecdb754dad151d83ac979a0213d898ee8e02eca0aca18aac52adcd9
SSDEEP

3072:+khfaKvLtC/N78aRX6AyKjNVnZTZNWz/6szqAw36lHDf+:+/KvLwljRX1yKpV1iLmAw6jf+

Score

10^/10

redline sectoprat forinstalls infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

forinstalls

C2

77.220.213.35:52349

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3640-8-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3640-8-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

6e10a6fbc11e4be9196d2218660c3073.exe

description pid process target process

PID 4072 set thread context of 3640 4072 6e10a6fbc11e4be9196d2218660c3073.exe 6e10a6fbc11e4be9196d2218660c3073.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6e10a6fbc11e4be9196d2218660c3073.exe6e10a6fbc11e4be9196d2218660c3073.exe

description pid process

Token: SeDebugPrivilege 4072 6e10a6fbc11e4be9196d2218660c3073.exe
Token: SeDebugPrivilege 3640 6e10a6fbc11e4be9196d2218660c3073.exe

description	pid	process	target process
PID 4072 set thread context of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe

description	pid	process
Token: SeDebugPrivilege	4072	6e10a6fbc11e4be9196d2218660c3073.exe
Token: SeDebugPrivilege	3640	6e10a6fbc11e4be9196d2218660c3073.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

6e10a6fbc11e4be9196d2218660c3073.exe

description	pid	process	target process
PID 4072 wrote to memory of 3476	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3476	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3476	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe
PID 4072 wrote to memory of 3640	4072	6e10a6fbc11e4be9196d2218660c3073.exe	6e10a6fbc11e4be9196d2218660c3073.exe

C:\Users\Admin\AppData\Local\Temp\6e10a6fbc11e4be9196d2218660c3073.exe
"C:\Users\Admin\AppData\Local\Temp\6e10a6fbc11e4be9196d2218660c3073.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\AppData\Local\Temp\6e10a6fbc11e4be9196d2218660c3073.exe
C:\Users\Admin\AppData\Local\Temp\6e10a6fbc11e4be9196d2218660c3073.exe
2⤵
PID:3476

C:\Users\Admin\AppData\Local\Temp\6e10a6fbc11e4be9196d2218660c3073.exe
C:\Users\Admin\AppData\Local\Temp\6e10a6fbc11e4be9196d2218660c3073.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6e10a6fbc11e4be9196d2218660c3073.exe.log
Filesize
605B

MD5
3654bd2c6957761095206ffdf92b0cb9

SHA1
6f10f7b5867877de7629afcff644c265e79b4ad3

SHA256
c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4

SHA512
e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79

Download Submit
memory/3640-16-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/3640-15-0x0000000004F70000-0x0000000004FAC000-memory.dmp

Filesize
240KB

Download
memory/3640-11-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/3640-19-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/3640-18-0x0000000005250000-0x000000000535A000-memory.dmp

Filesize
1.0MB

Download
memory/3640-17-0x0000000004FB0000-0x0000000004FFC000-memory.dmp

Filesize
304KB

Download
memory/3640-14-0x0000000004ED0000-0x0000000004EE2000-memory.dmp

Filesize
72KB

Download
memory/3640-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3640-12-0x00000000054C0000-0x0000000005AD8000-memory.dmp

Filesize
6.1MB

Download
memory/3640-20-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/4072-13-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4072-3-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4072-7-0x00000000055B0000-0x00000000055CE000-memory.dmp

Filesize
120KB

Download
memory/4072-2-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4072-0-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4072-6-0x00000000052F0000-0x0000000005366000-memory.dmp

Filesize
472KB

Download
memory/4072-5-0x0000000001390000-0x00000000013A4000-memory.dmp

Filesize
80KB

Download
memory/4072-4-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4072-1-0x0000000000880000-0x00000000008B8000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads