redline | 41304c1c586ec32aa4419c81090527cb7f811919174ffddac0f5a0a384cefb9a

General

Target

b6ff08d9ba3719f53ce0b1faac6e857b.exe
Size

378KB
MD5

b6ff08d9ba3719f53ce0b1faac6e857b
SHA1

01d7cd7e3131cf1c983aac7399e61235031d43c4
SHA256

41304c1c586ec32aa4419c81090527cb7f811919174ffddac0f5a0a384cefb9a
SHA512

cce5b6bb59cfd511eed18095b4e5febed22999a75aa97be923edba379226f682fdc4b78286c86c4d7ae76dfd4e5e087a45de8003c5f44642785f160be4016d1e
SSDEEP

6144:6ylYjxhUfR1GdkJEYPJqtjnsC093bVgOwoM8G4nb:nchsR1GdkJE2JqxnsC093bVgOwoW4nb

Score

10^/10

redline sectoprat focus1 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

Focus1

C2

135.148.139.222:33569

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2940-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2940-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2940-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2940-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2940-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2940-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2940-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2940-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2940-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2940-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

b6ff08d9ba3719f53ce0b1faac6e857b.exe

description pid process target process

PID 2740 set thread context of 2940 2740 b6ff08d9ba3719f53ce0b1faac6e857b.exe b6ff08d9ba3719f53ce0b1faac6e857b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b6ff08d9ba3719f53ce0b1faac6e857b.exe

description pid process

Token: SeDebugPrivilege 2940 b6ff08d9ba3719f53ce0b1faac6e857b.exe

description	pid	process	target process
PID 2740 set thread context of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe

description	pid	process
Token: SeDebugPrivilege	2940	b6ff08d9ba3719f53ce0b1faac6e857b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b6ff08d9ba3719f53ce0b1faac6e857b.exe

description	pid	process	target process
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe
PID 2740 wrote to memory of 2940	2740	b6ff08d9ba3719f53ce0b1faac6e857b.exe	b6ff08d9ba3719f53ce0b1faac6e857b.exe

C:\Users\Admin\AppData\Local\Temp\b6ff08d9ba3719f53ce0b1faac6e857b.exe
"C:\Users\Admin\AppData\Local\Temp\b6ff08d9ba3719f53ce0b1faac6e857b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2740

C:\Users\Admin\AppData\Local\Temp\b6ff08d9ba3719f53ce0b1faac6e857b.exe
C:\Users\Admin\AppData\Local\Temp\b6ff08d9ba3719f53ce0b1faac6e857b.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-0-0x0000000000F90000-0x0000000000FF4000-memory.dmp

Filesize
400KB

Download
memory/2740-1-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2740-2-0x0000000000B60000-0x0000000000BA0000-memory.dmp

Filesize
256KB

Download
memory/2740-14-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-15-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2940-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2940-16-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/2940-17-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads