redline | 38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a

General

Target

38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a.exe
Size

95KB
MD5

44b6f48a50be8b19b46773df9b712131
SHA1

e0a322b47ec2744abeda531092483f54c038faf9
SHA256

38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a
SHA512

095f4a5010c003ac657c075232b920e07400291666237027c472369e766c4a2e72a36b11909f2b701fbb6de511cec00912c2fd5741d0e4d28c42b399874c2526
SSDEEP

1536:9HqsIEq76ElbG6jejoigIY43Ywzi0Zb78ivombfexv0ujXyyed2jtmulgS6pM:91d+68YY+zi0ZbYe1g0ujyzdjM

Score

10^/10

redline sectoprat @systemadminbd discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

@systemadminbd

C2

172.86.101.115:4483

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3528-0-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3528-0-0x0000000000090000-0x00000000000AE000-memory.dmp	family_sectoprat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3528	38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a.exe
3528	38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a.exe

C:\Users\Admin\AppData\Local\Temp\38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a.exe
"C:\Users\Admin\AppData\Local\Temp\38d43a3a1f0bda152fdd683184cbc79aee1ce6f422fe7ac3841a8b8a6cca1b3a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC3FA.tmp

Filesize
28KB

MD5
7c9b4aa1339b221be616fdd1e10c291b

SHA1
8c92a03e2977f407223f6cfefb7ab126798ffc9b

SHA256
c4fd67d8e569422fca4acf20e9e1fe65c59053768666f19534769ee182d2109b

SHA512
886f772b65a1cf484a20deeb54a274586550edb269cb34d4dce78c3abe8425c77e34bbd321bd800fe8bab28e584e074d3275f7d9bdce80ee594c1e06b319c40a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC410.tmp

Filesize
33KB

MD5
2d659316193b6417b20bd99c2ace7ad8

SHA1
bdd9c4b944813074d3374cde2b6338400200232c

SHA256
2b22ebe22a113d6236e21d6f71089de1e750fca4d8514defe4097e3149a5b3be

SHA512
99652647c395706d929eb4cb165e39d7fe3a951ec37647c4f07cdd7336c0f616be23024a8771294aa6e8ef3fdd9df6dac519f926c7b345b7c27a71094ee52235

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC43B.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC441.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC457.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC482.tmp

Filesize
33KB

MD5
dfb4c02e39d58735614332a1c6f967eb

SHA1
a0068c1267bbc161514fa16bae8ac86d7fccc775

SHA256
9b6963974e75a54805fdc36409fb13a031533f8195c3d74e2ee314524a2ea48d

SHA512
5436881df90a033909221d74e0f5a8ba15d86c117c8ab1a186f73446c0676d7bbdabf20a3eadfd7a3030fd64ef1d63e291497989b2968bbca8761f8764eefef9

Download Submit
memory/3528-5-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/3528-6-0x0000000004BB0000-0x0000000004BFC000-memory.dmp

Filesize
304KB

Download
memory/3528-8-0x0000000074EC0000-0x0000000075671000-memory.dmp

Filesize
7.7MB

Download
memory/3528-9-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/3528-10-0x0000000006260000-0x0000000006422000-memory.dmp

Filesize
1.8MB

Download
memory/3528-11-0x0000000006960000-0x0000000006E8C000-memory.dmp

Filesize
5.2MB

Download
memory/3528-13-0x0000000006430000-0x0000000006496000-memory.dmp

Filesize
408KB

Download
memory/3528-12-0x0000000007440000-0x00000000079E6000-memory.dmp

Filesize
5.6MB

Download
memory/3528-53-0x0000000006F30000-0x0000000006FC2000-memory.dmp

Filesize
584KB

Download
memory/3528-7-0x0000000004E20000-0x0000000004F2A000-memory.dmp

Filesize
1.0MB

Download
memory/3528-0-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/3528-4-0x0000000004B70000-0x0000000004BAC000-memory.dmp

Filesize
240KB

Download
memory/3528-208-0x0000000006FD0000-0x0000000007046000-memory.dmp

Filesize
472KB

Download
memory/3528-3-0x0000000004B10000-0x0000000004B22000-memory.dmp

Filesize
72KB

Download
memory/3528-209-0x00000000071A0000-0x00000000071BE000-memory.dmp

Filesize
120KB

Download
memory/3528-2-0x00000000052E0000-0x00000000058F8000-memory.dmp

Filesize
6.1MB

Download
memory/3528-1-0x0000000074EC0000-0x0000000075671000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing