redline | a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36

General

Target

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
Size

1.0MB
MD5

464709f3215d06f6703eb4ecb607ae7a
SHA1

1f438f2ab699f842cec119981ae5bf799df5d203
SHA256

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36
SHA512

007b3d6c7da18c9d8b31991520d18fa2ee323cf8b4d8ea153d74cf93d5bfb38df79bc65a968cc6e07c996c451f0f1c8b2a0b9f0529a6b67ca148cc27adf1eda9
SSDEEP

24576:3AHnh+eWsN3skA4RV1Hom2KXMmHaeAfg3sujtg5:qh+ZkldoPK8YaeAfTYg

Score

10^/10

redline sectoprat wordfile infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

wordfile

C2

185.38.142.10:7474

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2448-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2448-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2448-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2448-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2448-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2448-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2448-11-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/2448-13-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/2448-15-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

description	pid	process	target process
PID 2020 set thread context of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2448 RegSvcs.exe
2448 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

pid process

2020 a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2448 RegSvcs.exe

pid	process
2448	RegSvcs.exe
2448	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2448	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

pid	process
2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

pid	process
2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe

description	pid	process	target process
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe
PID 2020 wrote to memory of 2448	2020	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe
"C:\Users\Admin\AppData\Local\Temp\a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d65cbcf7a38947fa8bd27f1e2219f6

SHA1
ed05132afda35cef4100c482cae1c240e6d0998a

SHA256
3f91c6bc39df53ca4cd63c15400c70640fe78aa7c80991c9847e09fc61ae68d7

SHA512
f4c877eee44d6c25cda18d409e76d5c93b85acdb4a75ea4338fe0761f2a64426034bfe3b54ce1dadd917ae7429ec19fb9ff375f6e7983c25aacf10df86414b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ED0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F5F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp356C.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3581.tmp

Filesize
92KB

MD5
f5582ab8cd4909e3531c32d3a28f156e

SHA1
40402c9af7fcff602e5efb662a08a3577b019379

SHA256
da23680ac69b11618f023c43695198e3ab7ace6b831fd2e189d81d15aa333ad6

SHA512
1f1a3bf4b03621518013f064c777e56eb6594e53e39e589f7c274993cc188c3b800986a5d6b15131e64c3b76b74af7d68ef43ae29794db0b8e3ec9862382195f

Download Submit
memory/2020-10-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download
memory/2448-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2448-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2448-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2448-16-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

Filesize
4KB

Download
memory/2448-17-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/2448-166-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads