redline | 7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda

General

Target

7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe
Size

95KB
MD5

66b2fe6065c9cb69baa4e263a0d19c4b
SHA1

cb1d74c1de469a815a777f26d8150f636c689f52
SHA256

7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda
SHA512

1b675dcc354e5f1fcc79245674f32a4f6ec1bf911006c19b60374950b0dd34f126e4122412c17ff581d18032d4beb4b965378d19384824e69b1732094ba8637e
SSDEEP

1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed273tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdTY

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

94.228.162.55:4483

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-0-0x00000000002F0000-0x000000000030E000-memory.dmp	family_redline
behavioral1/memory/1992-2-0x0000000004A80000-0x0000000004AC0000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-0-0x00000000002F0000-0x000000000030E000-memory.dmp	family_sectoprat
behavioral1/memory/1992-2-0x0000000004A80000-0x0000000004AC0000-memory.dmp	family_sectoprat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-0-0x00000000002F0000-0x000000000030E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/1992-2-0x0000000004A80000-0x0000000004AC0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe

pid	process
1992	7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe
1992	7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe

description pid process

Token: SeDebugPrivilege 1992 7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe

description	pid	process
Token: SeDebugPrivilege	1992	7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe

C:\Users\Admin\AppData\Local\Temp\7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe
"C:\Users\Admin\AppData\Local\Temp\7047f033fcf8a32d52e47569e8c9768905eb4a588bbfb4582ae31c6ade0f7dda.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C8B.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42DA.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42F0.tmp
Filesize
92KB

MD5
18e04095708297d6889a6962f81e8d8f

SHA1
9a25645db1da0217092c06579599b04982192124

SHA256
4ed16c019fe50bb4ab1c9dcedf0e52f93454b5dbaf18615d60761e7927b69fb7

SHA512
45ec57bddeeb8bca05babcf8da83bf9db630819b23076a1cf79f2e54b3e88e14cd7db650332554026ab5e8634061dd699f322bcba6683765063e67ac47ea1caf

Download Submit
memory/1992-0-0x00000000002F0000-0x000000000030E000-memory.dmp

Filesize
120KB

Download
memory/1992-1-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/1992-2-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download
memory/1992-118-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/1992-119-0x0000000004A80000-0x0000000004AC0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads