redline | 7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4

General

Target

7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe
Size

95KB
MD5

9001b4d829eac33f2b06ab34bbef7480
SHA1

108914745f61a7502a382871345d4af604814823
SHA256

7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4
SHA512

511cedc75dc75eef63953f7238d1d7f25b6ffc0e36f0f6e0589d58f642b4c87607a70414305905a7b57295ebe176bf51c1a84d0308f0f93287e52b3afd3b4cea
SSDEEP

1536:WqsoPqsglbG6jejoigIn43Ywzi0Zb78ivombfexv0ujXyyed2jtQulgS6pE:E2fwYn+zi0ZbYe1g0ujyzdlE

Score

10^/10

redline sectoprat --- https://t.me/bltoolscloud ------ https://t.me/bltools_logs ---discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

--- https://t.me/BlToolsCloud ------ https://t.me/BlTools_Logs ---

C2

rights-mountains.gl.at.ply.gg:23403

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2176-0-0x0000000001390000-0x00000000013AE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2176-0-0x0000000001390000-0x00000000013AE000-memory.dmp	family_sectoprat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/memory/2176-0-0x0000000001390000-0x00000000013AE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe
2176	7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe

C:\Users\Admin\AppData\Local\Temp\7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe
"C:\Users\Admin\AppData\Local\Temp\7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8695.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9178.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp918D.tmp

Filesize
92KB

MD5
779a64d3b63005fdbbf038d13d629ccf

SHA1
60cbd8053df4b0cb8323e94d3699b3157dfc7e74

SHA256
3b898b42d0cb65119d4f54d291eb1b114769cf7e99a52d218a17fea5eb977ada

SHA512
f70ad818b6edaad89d5effc0c2fb05dde9cad16600899265915eba500d8bf1100564ad6a3fd9c4fd9f0e84bab889ed5b4732aa7648e4dd239e999aa172356218

Download Submit
memory/2176-0-0x0000000001390000-0x00000000013AE000-memory.dmp

Filesize
120KB

Download
memory/2176-1-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2176-2-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2176-121-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2176-122-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2176-123-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing