redline | 42d833abf34a03935caccf12b8f6c06ff9c1c85d7774cbffbe928325eb35e524

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe
Size 2.5MB
Sample240705-eh6exasbpn
SHA256 c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204
MD5 5d86465e46f3f4908c9a46d5d01d4e71
SHA1 75edb31f75d72a97a69537263bbe80bb67747d4a
SHA512 d1f2817cda26c758b82168b2640d9bc16b17d3ad5e2d2724c8d3f54542f4437bb49132cc39d905f3e7b4b1b4800f800158bc1c15644c0b1668bff81c00d751ce
SSDEEP 12288:WpsNYpx8SP/SicSylpH76uoRUxDK/Hpt9kBJGcK/:8sSpbnSictuuoRUxgtc5K/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat halle evasion execution infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

halle

194.55.186.180:55123

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2596-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2596-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2596-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2596-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2596-22-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2596-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2596-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2596-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2596-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2596-22-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2740	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2740	powershell.exe
2596	regsvcs.exe
2596	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2596	regsvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2740	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	31
PID 1356 wrote to memory of 2740	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	31
PID 1356 wrote to memory of 2740	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	31
PID 1356 wrote to memory of 2848	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	33
PID 1356 wrote to memory of 2848	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	33
PID 1356 wrote to memory of 2848	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	33
PID 1356 wrote to memory of 2848	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	33
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 2596	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	34
PID 1356 wrote to memory of 1312	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	36
PID 1356 wrote to memory of 1312	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	36
PID 1356 wrote to memory of 1312	1356	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe	36

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe

C:\Users\Admin\AppData\Local\Temp\c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe
"C:\Users\Admin\AppData\Local\Temp\c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c381309bd93b871a4ffecad472cb82fa30387ea32f31ca0fa23ee261aa4ad204.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1356 -s 896
  2⤵
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpDAF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDAF6.tmp
Size 46KB
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
SSDEEP 96:9SXNKLyeymwHCn8MouOFlRGiZqYtFTCG:9SfHG7qqifTCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpDB4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDB4A.tmp
Size 92KB
SHA256 58ea6de2879649260c0a62b6e8e045e88c3311978e993f63a8dfcdb0dba9f05d
MD5 dd6944619a1cff7c63c0e49ed65368ca
SHA1 a055ce9efa2206cdc35b924d43a5d06f453ce777
SHA512 856d454cd202fc39bec08f7ea7fb9c631e5531c1d5ffc269d3ea4ef2cdd568b176da0f8e00ffd8c80eaad461cecbce213fa4cd46b142a7760fd32815261fddd7
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is6TJVum3:/Ravrbl9D9pnaVh6lYJVum3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1356-0-0x000007FEF5E23000-0x000007FEF5E24000-memory.dmp

Download

memory/1356-1-0x0000000000B50000-0x0000000000B6E000-memory.dmp

Download

memory/1356-2-0x000000001B1E0000-0x000000001B1FE000-memory.dmp

Download

memory/1356-3-0x00000000003B0000-0x0000000000420000-memory.dmp

Download

memory/1356-4-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Download

memory/1356-100-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Download

memory/1356-99-0x000007FEF5E23000-0x000007FEF5E24000-memory.dmp

Download

memory/2596-22-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2596-18-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2596-16-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2596-12-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2596-14-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2596-23-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2596-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2596-21-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2740-11-0x0000000002290000-0x0000000002298000-memory.dmp

Download

memory/2740-10-0x000000001B220000-0x000000001B502000-memory.dmp

Download

memory/2740-9-0x0000000002770000-0x00000000027F0000-memory.dmp

Download