redline | 94e830018fa0898f97b4fc3206d53889ec7a4c042960604ddacc504d8b30263a

General

Target

b43d95a738a1a7df7245a3fcb11b3d37.exe
Size

202KB
MD5

b43d95a738a1a7df7245a3fcb11b3d37
SHA1

b000576e0a198e364af0e07eeb13f993e43643ea
SHA256

94e830018fa0898f97b4fc3206d53889ec7a4c042960604ddacc504d8b30263a
SHA512

04045eaf33bb19e347f890d8c3fee682c8c03575d585c5b52e05afd813c6d7fbb9f634f2b40187c85a09d6b433971d3848bd1fdd4671bfd7b32c4dcafd2b4951
SSDEEP

3072:PyLT1pRNE9Sof7at5ytD153ZlwQNdMUXDOF3hFVIgrFukl7Csd:0hpRNOSQatKDPZ+maDVzxuklr

Score

10^/10

redline sectoprat @youlovedevil infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@youlovedevil

C2

45.81.227.32:22625

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2768-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2768-12-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2768-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2768-20-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2768-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 7 IoCs

resource	yara_rule
behavioral1/memory/2768-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2768-12-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2768-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2768-20-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2768-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2768-22-0x0000000002140000-0x0000000002180000-memory.dmp	family_sectoprat
behavioral1/memory/2768-24-0x0000000002140000-0x0000000002180000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	b43d95a738a1a7df7245a3fcb11b3d37.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28
PID 2320 wrote to memory of 2768	2320	b43d95a738a1a7df7245a3fcb11b3d37.exe	28

C:\Users\Admin\AppData\Local\Temp\b43d95a738a1a7df7245a3fcb11b3d37.exe
"C:\Users\Admin\AppData\Local\Temp\b43d95a738a1a7df7245a3fcb11b3d37.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\b43d95a738a1a7df7245a3fcb11b3d37.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-0-0x0000000000AE0000-0x0000000000B1C000-memory.dmp

Filesize
240KB

Download
memory/2320-1-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2320-2-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2320-3-0x0000000000840000-0x0000000000880000-memory.dmp

Filesize
256KB

Download
memory/2320-4-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2320-5-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2320-6-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2320-17-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2768-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2768-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-20-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2768-21-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2768-22-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download
memory/2768-23-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2768-24-0x0000000002140000-0x0000000002180000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing