redline | bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6

General

Target

bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe
Size

95KB
MD5

735c15c37831cdc319c03f4f7971da49
SHA1

166949cdb534d97c564adc27f297406a4bf38204
SHA256

bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6
SHA512

3c9227b9472d7840f74363b9801756923de56fcff5349f6e287206531c0da4717a9de520322d122bef30f7b66fdbeaac715ebbe64389de89b1c7d5e832e87ac8
SSDEEP

1536:9qskXqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2OtmulgS6pY:rCgzWHY3+zi0ZbYe1g0ujyzd6Y

Score

10^/10

redline sectoprat exodus discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

exodus

C2

94.156.8.229:1334

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3020-1-0x0000000000690000-0x00000000006AE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3020-1-0x0000000000690000-0x00000000006AE000-memory.dmp	family_sectoprat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe

pid	process
3020	bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe
3020	bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe

description pid process

Token: SeDebugPrivilege 3020 bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe

description	pid	process
Token: SeDebugPrivilege	3020	bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe

C:\Users\Admin\AppData\Local\Temp\bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe
"C:\Users\Admin\AppData\Local\Temp\bb762ded17b408634ecd0675d9e823cebd7984cca8cfc53afe5f3665cde3dee6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp87F4.tmp
Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8809.tmp
Filesize
100KB

MD5
f41313027e007e8110c7ea9908ab5aac

SHA1
e36a4121ba9d9dc35dbc37d6574a203f5f50fa47

SHA256
34b9c5f8f3680de7b036da6e03cf6a7f08d28327d4f083cb1bdfef53bb96c654

SHA512
7cbde14eda28093acf119298719e7bfc9fa6e2baf20fa1c263da5719fad3997ed54c371959298661807750bce1d1ca237e03af8aed81bdc34eaefe63b5af4c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8825.tmp
Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp883B.tmp
Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8841.tmp
Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp885C.tmp
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
memory/3020-5-0x00000000051B0000-0x00000000051FC000-memory.dmp

Filesize
304KB

Download
memory/3020-31-0x0000000007900000-0x0000000007EA6000-memory.dmp

Filesize
5.6MB

Download
memory/3020-8-0x0000000006720000-0x00000000068E2000-memory.dmp

Filesize
1.8MB

Download
memory/3020-9-0x0000000006E20000-0x000000000734C000-memory.dmp

Filesize
5.2MB

Download
memory/3020-10-0x00000000068F0000-0x0000000006956000-memory.dmp

Filesize
408KB

Download
memory/3020-29-0x0000000006C00000-0x0000000006C92000-memory.dmp

Filesize
584KB

Download
memory/3020-30-0x0000000006CA0000-0x0000000006D16000-memory.dmp

Filesize
472KB

Download
memory/3020-7-0x0000000005420000-0x000000000552A000-memory.dmp

Filesize
1.0MB

Download
memory/3020-32-0x0000000006E00000-0x0000000006E1E000-memory.dmp

Filesize
120KB

Download
memory/3020-6-0x00000000743B0000-0x0000000074B61000-memory.dmp

Filesize
7.7MB

Download
memory/3020-0-0x00000000743BE000-0x00000000743BF000-memory.dmp

Filesize
4KB

Download
memory/3020-4-0x0000000005170000-0x00000000051AC000-memory.dmp

Filesize
240KB

Download
memory/3020-3-0x0000000005110000-0x0000000005122000-memory.dmp

Filesize
72KB

Download
memory/3020-2-0x0000000005840000-0x0000000005E58000-memory.dmp

Filesize
6.1MB

Download
memory/3020-1-0x0000000000690000-0x00000000006AE000-memory.dmp

Filesize
120KB

Download
memory/3020-188-0x00000000743B0000-0x0000000074B61000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads