redline | 860654fef70c2666264610d36473c9c2b2772a3c8aa8f633630401dbd1f359ab

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe
Size

95KB
MD5

7a8ecbc488543dd3ce6cfe5ba9d5cd8b
SHA1

87031bf7d870ffb4a6bec6e44a38045834017b50
SHA256

5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e
SHA512

e6f9080c58f1f10fdcedb23e4efd525ad4a40573c0f69f65d8ec3f6e5de45544bd8b5b96ad6603e1b291eb6697b3ed03cd4265d9249ffe90fcc22ef977f95eef
SSDEEP

1536:Fqsgaq+A/lbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2/3teulgS6pQl:DfZeYP+zi0ZbYe1g0ujyzdjQ

Score

10^/10

redline sectoprat cheat infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

0.tcp.eu.ngrok.io:18950

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2144-0-0x0000000000DF0000-0x0000000000E0E000-memory.dmp	family_redline
behavioral1/memory/2144-2-0x0000000004A50000-0x0000000004A90000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2144-0-0x0000000000DF0000-0x0000000000E0E000-memory.dmp	family_sectoprat
behavioral1/memory/2144-2-0x0000000004A50000-0x0000000004A90000-memory.dmp	family_sectoprat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

2 0.tcp.eu.ngrok.io
31 0.tcp.eu.ngrok.io
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe

description pid process

Token: SeDebugPrivilege 2144 5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe

flow	ioc
2	0.tcp.eu.ngrok.io
31	0.tcp.eu.ngrok.io

description	pid	process
Token: SeDebugPrivilege	2144	5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe

C:\Users\Admin\AppData\Local\Temp\5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe
"C:\Users\Admin\AppData\Local\Temp\5ecf0dade29bc4365035554275d07a72b112d0b6bc7487cef6a1c40ed50ea28e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x0000000000DF0000-0x0000000000E0E000-memory.dmp

Filesize
120KB

Download
memory/2144-1-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2144-2-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2144-3-0x0000000074A80000-0x000000007516E000-memory.dmp

Filesize
6.9MB

Download
memory/2144-4-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download