redline | 433f08a0802eeb0fc8054d085035540369602e732ccb506a6f5d9ecf7b35dadb

General

Target

ddd699374ed38b0ab8c223579623e351.exe
Size

372KB
MD5

ddd699374ed38b0ab8c223579623e351
SHA1

7304e2dc234bd005d373985b045e92c0cf167b31
SHA256

433f08a0802eeb0fc8054d085035540369602e732ccb506a6f5d9ecf7b35dadb
SHA512

abba31102415791c0112c5ba8231c34cc96c431fb88e0875136fe7f12b3e83969030c36132c107c16b4ffd678676830b439fea6bdd21da2d9867e38fe208ae3f
SSDEEP

6144:JHqM4Ry8nba6xa7AELWjhCOyAXdFH3ONJ7Caooxb:AM4E2a6xa7AELWjhCOyAXdFH3ONJ7Caz

Score

10^/10

redline sectoprat build1 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

build1

C2

193.38.54.112:4623

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2872-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2872-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2872-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2872-16-0x0000000004AF0000-0x0000000004B30000-memory.dmp	family_sectoprat
behavioral1/memory/2872-18-0x0000000004AF0000-0x0000000004B30000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

ddd699374ed38b0ab8c223579623e351.exe

description pid process target process

PID 1748 set thread context of 2872 1748 ddd699374ed38b0ab8c223579623e351.exe ddd699374ed38b0ab8c223579623e351.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ddd699374ed38b0ab8c223579623e351.exe

description pid process

Token: SeDebugPrivilege 2872 ddd699374ed38b0ab8c223579623e351.exe

description	pid	process	target process
PID 1748 set thread context of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe

description	pid	process
Token: SeDebugPrivilege	2872	ddd699374ed38b0ab8c223579623e351.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ddd699374ed38b0ab8c223579623e351.exe

description	pid	process	target process
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe
PID 1748 wrote to memory of 2872	1748	ddd699374ed38b0ab8c223579623e351.exe	ddd699374ed38b0ab8c223579623e351.exe

C:\Users\Admin\AppData\Local\Temp\ddd699374ed38b0ab8c223579623e351.exe
"C:\Users\Admin\AppData\Local\Temp\ddd699374ed38b0ab8c223579623e351.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\ddd699374ed38b0ab8c223579623e351.exe
C:\Users\Admin\AppData\Local\Temp\ddd699374ed38b0ab8c223579623e351.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-0-0x0000000000190000-0x00000000001F4000-memory.dmp

Filesize
400KB

Download
memory/1748-1-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/1748-2-0x0000000000900000-0x0000000000940000-memory.dmp

Filesize
256KB

Download
memory/1748-14-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2872-3-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-15-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-16-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Filesize
256KB

Download
memory/2872-17-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-18-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads