redline | 897676bf56a0dd969a5c9e566e05a0ca8c401d4d0c2002cbca223f249687f682

General

Target

871cba396875673097c170edb571a972.exe
Size

586KB
MD5

871cba396875673097c170edb571a972
SHA1

18e925fd8597c1deefd28832ad428744577e6eb0
SHA256

897676bf56a0dd969a5c9e566e05a0ca8c401d4d0c2002cbca223f249687f682
SHA512

39c249e77dc39e78adbf7b599df6cf81519438366cf13700f57500aeb71f663260cb10118630981a12da94bc6a54ca36b68873d2158d5a22d628607b2c445e63
SSDEEP

12288:Wk7XjhEnob5eA1God0C3RX7Vo9KAQVbqbO/bruWCFKGj:dGoD13l

Score

10^/10

redline sectoprat 777 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

777

C2

45.147.231.225:40668

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2720-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2720-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2720-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2720-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2720-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2720-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2720-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2720-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2720-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2720-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

871cba396875673097c170edb571a972.exe

description pid process target process

PID 2536 set thread context of 2720 2536 871cba396875673097c170edb571a972.exe 871cba396875673097c170edb571a972.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

871cba396875673097c170edb571a972.exe

description pid process

Token: SeDebugPrivilege 2720 871cba396875673097c170edb571a972.exe

description	pid	process	target process
PID 2536 set thread context of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe

description	pid	process
Token: SeDebugPrivilege	2720	871cba396875673097c170edb571a972.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

871cba396875673097c170edb571a972.exe

description	pid	process	target process
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe
PID 2536 wrote to memory of 2720	2536	871cba396875673097c170edb571a972.exe	871cba396875673097c170edb571a972.exe

C:\Users\Admin\AppData\Local\Temp\871cba396875673097c170edb571a972.exe
"C:\Users\Admin\AppData\Local\Temp\871cba396875673097c170edb571a972.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\871cba396875673097c170edb571a972.exe
C:\Users\Admin\AppData\Local\Temp\871cba396875673097c170edb571a972.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000000A20000-0x0000000000AB8000-memory.dmp

Filesize
608KB

Download
memory/2536-1-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2536-2-0x0000000004890000-0x00000000048D0000-memory.dmp

Filesize
256KB

Download
memory/2536-15-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2720-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2720-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-14-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2720-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2720-16-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2720-17-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads