redline | 37cdcbf1a254917646199a07442c5d67c4cca28ced381c0d79b14224e8fdca5f

General

Target

Slinky.exe
Size

18.5MB
MD5

7c1e228c63aef5d1775c065a5597cccf
SHA1

9d5768654e927ba34a1a2e4a8a850a9dc6350e0d
SHA256

37cdcbf1a254917646199a07442c5d67c4cca28ced381c0d79b14224e8fdca5f
SHA512

a6f902dacc333ab12e8b4d1d395d007cd7100253aa2ab2b49bc3749f42064f99215e370a301b0e07f34c681fb1a9ebe0a45f4cc00119fbaa5f6309560f325db0
SSDEEP

393216:TKRqNWNKROYkhkpXorNv+oXsDS3LNK3HOU6x0pW/lJktSrZPLAB:eANWKRrpYrNvou7NK3uU6E29dPL

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

147.185.221.19:32513

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\build.exe	family_redline
behavioral3/memory/2532-23-0x0000000000A00000-0x0000000000A1E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1656-0-0x0000000000CD0000-0x0000000001F4C000-memory.dmp	family_sectoprat
C:\Users\Admin\AppData\Local\Temp\build.exe	family_sectoprat
behavioral3/memory/2532-23-0x0000000000A00000-0x0000000000A1E000-memory.dmp	family_sectoprat

Executes dropped EXE 2 IoCs

Processes:

build.exeslinkyloader.exe

pid process

2532 build.exe
2804 slinkyloader.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2532	build.exe
2804	slinkyloader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

slinkyloader.exebuild.exe

pid	process
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2532	build.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2532	build.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe
2804	slinkyloader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

build.exe

description pid process

Token: SeDebugPrivilege 2532 build.exe

description	pid	process
Token: SeDebugPrivilege	2532	build.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Slinky.exe

description	pid	process	target process
PID 1656 wrote to memory of 2532	1656	Slinky.exe	build.exe
PID 1656 wrote to memory of 2532	1656	Slinky.exe	build.exe
PID 1656 wrote to memory of 2532	1656	Slinky.exe	build.exe
PID 1656 wrote to memory of 2804	1656	Slinky.exe	slinkyloader.exe
PID 1656 wrote to memory of 2804	1656	Slinky.exe	slinkyloader.exe

C:\Users\Admin\AppData\Local\Temp\Slinky.exe
"C:\Users\Admin\AppData\Local\Temp\Slinky.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
95KB

MD5
ddad08ac0b9c4fc1eec301751fa7eb3f

SHA1
d923eac0c7d90353057bda6f43d5531896027c1a

SHA256
7c7155e558d62b31045f0988e8bec3a5ef7ab658077d293a8d76de2feb773e42

SHA512
7eb1bc320da05b5f275cd3a7e238dd67d490dee9faea1798aefd80fc2856185bdb0bd87b6da2d55ff501c2bbd969e7e80e229e6f5b18330a93e6a688cc2847ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
Filesize
18.4MB

MD5
a2223005e6d186689577e5a2b785a16b

SHA1
1075e177247880d3e1ec940623500bf2e9b275e3

SHA256
cef5b60321f17991400a19072052535638c0a5c02d338234686552deadeea82e

SHA512
073f8e682d2468bfe7d55b82cf0ff5dafd2754da2813de2116551e2811809debba7f06c5d8ed5901a59703bfb306fd5fd05d9d1e797bf9e7887826709c6993c6

Download Submit
memory/1656-25-0x00007FFDAE990000-0x00007FFDAF452000-memory.dmp

Filesize
10.8MB

Download
memory/1656-0-0x0000000000CD0000-0x0000000001F4C000-memory.dmp

Filesize
18.5MB

Download
memory/1656-2-0x000000001CD10000-0x000000001CD20000-memory.dmp

Filesize
64KB

Download
memory/1656-1-0x00007FFDAE990000-0x00007FFDAF452000-memory.dmp

Filesize
10.8MB

Download
memory/2532-30-0x00000000053A0000-0x00000000053DC000-memory.dmp

Filesize
240KB

Download
memory/2532-35-0x0000000007190000-0x00000000076BC000-memory.dmp

Filesize
5.2MB

Download
memory/2532-28-0x0000000005B70000-0x0000000006188000-memory.dmp

Filesize
6.1MB

Download
memory/2532-29-0x0000000002E50000-0x0000000002E62000-memory.dmp

Filesize
72KB

Download
memory/2532-24-0x0000000075110000-0x00000000758C1000-memory.dmp

Filesize
7.7MB

Download
memory/2532-31-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/2532-32-0x00000000053E0000-0x000000000542C000-memory.dmp

Filesize
304KB

Download
memory/2532-33-0x0000000005660000-0x000000000576A000-memory.dmp

Filesize
1.0MB

Download
memory/2532-34-0x0000000006A90000-0x0000000006C52000-memory.dmp

Filesize
1.8MB

Download
memory/2532-23-0x0000000000A00000-0x0000000000A1E000-memory.dmp

Filesize
120KB

Download
memory/2532-57-0x0000000006C60000-0x0000000006CC6000-memory.dmp

Filesize
408KB

Download
memory/2532-58-0x0000000006F50000-0x0000000006FC6000-memory.dmp

Filesize
472KB

Download
memory/2532-59-0x0000000007070000-0x0000000007102000-memory.dmp

Filesize
584KB

Download
memory/2532-60-0x0000000007C70000-0x0000000008216000-memory.dmp

Filesize
5.6MB

Download
memory/2532-61-0x0000000007150000-0x000000000716E000-memory.dmp

Filesize
120KB

Download
memory/2532-62-0x0000000075110000-0x00000000758C1000-memory.dmp

Filesize
7.7MB

Download
memory/2532-63-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads