redline | f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e

General

Target

f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe
Size

3.5MB
MD5

190b0ac75df86273bee149b077568953
SHA1

9165381865ee452f50ee4cd33a9e18ec27c72b37
SHA256

f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e
SHA512

22ea9c61de288b7d5192fcde981e1960307404c1b042cfcbcfcd2fae6d8a133c1be6d634452ee24b78186901eec2772c8d082127b175f38b8c6a7b9b0c379f4e
SSDEEP

98304:StMGmkkPTtxYwM6meiKt38llaR+bDBpWxi9RL4Qs:StQkUT8Kt3OhTWA9RL4V

Score

10^/10

redline zgrat 123 infostealer rat

Malware Config

Extracted

Family

redline

Botnet

123

C2

193.233.132.169:37732

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3936-0-0x0000000000EF0000-0x0000000001260000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1512-20-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3936 set thread context of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72
PID 3936 wrote to memory of 1512	3936	f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe	72

C:\Users\Admin\AppData\Local\Temp\f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe
"C:\Users\Admin\AppData\Local\Temp\f73000915c05e496a9b7e1d21c109c0ef326fe9b20a7b6ac9ee20c09ecb7d10e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TmpE88B.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/1512-44-0x0000000005CF0000-0x0000000005D66000-memory.dmp

Filesize
472KB

Download
memory/1512-27-0x00000000052E0000-0x00000000052EA000-memory.dmp

Filesize
40KB

Download
memory/1512-52-0x00000000736A0000-0x0000000073D8E000-memory.dmp

Filesize
6.9MB

Download
memory/1512-51-0x0000000006D50000-0x0000000006D9B000-memory.dmp

Filesize
300KB

Download
memory/1512-50-0x0000000006D10000-0x0000000006D4E000-memory.dmp

Filesize
248KB

Download
memory/1512-49-0x0000000006CB0000-0x0000000006CC2000-memory.dmp

Filesize
72KB

Download
memory/1512-48-0x0000000008500000-0x000000000860A000-memory.dmp

Filesize
1.0MB

Download
memory/1512-47-0x0000000006DB0000-0x00000000073B6000-memory.dmp

Filesize
6.0MB

Download
memory/1512-20-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1512-45-0x0000000006440000-0x000000000645E000-memory.dmp

Filesize
120KB

Download
memory/1512-22-0x00000000736A0000-0x0000000073D8E000-memory.dmp

Filesize
6.9MB

Download
memory/1512-26-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/1512-25-0x00000000051F0000-0x0000000005282000-memory.dmp

Filesize
584KB

Download
memory/1512-24-0x00000000056F0000-0x0000000005BEE000-memory.dmp

Filesize
5.0MB

Download
memory/3936-14-0x0000000006210000-0x0000000006220000-memory.dmp

Filesize
64KB

Download
memory/3936-1-0x00000000736A0000-0x0000000073D8E000-memory.dmp

Filesize
6.9MB

Download
memory/3936-0-0x0000000000EF0000-0x0000000001260000-memory.dmp

Filesize
3.4MB

Download
memory/3936-18-0x00000000063F0000-0x00000000064F0000-memory.dmp

Filesize
1024KB

Download
memory/3936-19-0x00000000063F0000-0x00000000064F0000-memory.dmp

Filesize
1024KB

Download
memory/3936-17-0x00000000063F0000-0x00000000064F0000-memory.dmp

Filesize
1024KB

Download
memory/3936-16-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-3-0x00000000736A0000-0x0000000073D8E000-memory.dmp

Filesize
6.9MB

Download
memory/3936-23-0x00000000736A0000-0x0000000073D8E000-memory.dmp

Filesize
6.9MB

Download
memory/3936-15-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-12-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-13-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-11-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/3936-2-0x0000000005AC0000-0x0000000005B5C000-memory.dmp

Filesize
624KB

Download
memory/3936-5-0x0000000005F20000-0x00000000060B2000-memory.dmp

Filesize
1.6MB

Download
memory/3936-4-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing