redline | hxxps://gofile[.]io/d/SRT9tP

Resubmissions

05/07/2024, 16:54

240705-vesbwavapf10

05/07/2024, 16:49

04/07/2024, 16:17

04/07/2024, 16:14

04/07/2024, 16:11

Analysis

max time kernel
536s
max time network
540s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/SRT9tP
Sample240705-vesbwavapf

Score

10^/10

redline sectoprat s6murai on telegram infostealer persistence rat trojan

Malware Config

Extracted

Family

redline

Botnet

s6murai on telegram

178.40.160.213:3333

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2732-252-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2732-252-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Executes dropped EXE 1 IoCs

pid	Process
1684	Panel.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Unkown = "C:\\Windows\\system32\\chome_exe\\CraxSMS Beta test.exe"	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\chome_exe\CraxSMS Beta test.exe	Panel.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 2732	1684	Panel.exe	121

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
3224	msedge.exe
3224	msedge.exe
2456	identity_helper.exe
2456	identity_helper.exe
1188	msedge.exe
1188	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
3952	powershell.exe
3952	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3916	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4252	7zG.exe
Token: 35	4252	7zG.exe
Token: SeSecurityPrivilege	4252	7zG.exe
Token: SeSecurityPrivilege	4252	7zG.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	2732	RegAsm.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
4252	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe
3916	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 3460	3224	msedge.exe	82
PID 3224 wrote to memory of 3460	3224	msedge.exe	82
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 4992	3224	msedge.exe	84
PID 3224 wrote to memory of 2644	3224	msedge.exe	85
PID 3224 wrote to memory of 2644	3224	msedge.exe	85
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86
PID 3224 wrote to memory of 1368	3224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/SRT9tP
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2cf446f8,0x7fff2cf44708,0x7fff2cf44718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,13539973022969699752,6649473215604131324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4888

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Redline Crack\" -ad -an -ai#7zMap25603:88:7zEvent9271
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3916
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline Crack\Redline Crack\Panel\RedLine_20_2\Panel\serviceSettings.json
  2⤵
  PID:4464

C:\Users\Admin\Downloads\Redline Crack\Redline Crack\Panel\RedLine_20_2\Panel\Panel.exe
"C:\Users\Admin\Downloads\Redline Crack\Redline Crack\Panel\RedLine_20_2\Panel\Panel.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:1684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Unkown';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Unkown' -Value '"C:\Windows\system32\chome_exe\CraxSMS Beta test.exe"' -PropertyType 'String'
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777
MD5 b6c11a2e74ef272858b9bcac8f5ebf97
SHA1 2a06945314ebaa78f3ede1ff2b79f7357c3cb36b
SHA512 d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07
MD5 9abb787f6c5a61faf4408f694e89b50e
SHA1 914247144868a2ff909207305255ab9bbca33d7e
SHA512 0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 47afbc9510efee26752695d3fdda040a4fe63bb0d86744a62ea4e609a25812e2
MD5 165c2363f13be0a7417fa87a91b4b992
SHA1 3ae1cb8ad1d3e72b07d53e8a5258d7ff4c075048
SHA512 e6defce922b7cdffb5d44bafe824d3d2230bf825c11c16c5f06a4b5df0c0712c7e8c05205cc31e8cb02ae7a0193d2ccf9e3a2e3550ab9dbd6ba752165d256ae9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 317B
SHA256 b5e81a7c7d80feaaa10ee7bc8aaef9f21a5c1e4b03b3823ed115022311d674a0
MD5 afc6cddd7e64d81e52b729d09f227107
SHA1 ad0d3740f4b66de83db8862911c07dc91928d2f6
SHA512 844edb69585153c378a7c97709983776fc9303a32fb5ef8122ecca32adfc0b265f5ef7118ee07814da5c020ac7ba1bf2a2f66d46312e4d8e6df99aab2e5f9b2a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee7c64064f98b0afdba8c8d3e5500d0128eac552918fb0fa5a43860f74e9b819
MD5 acceed7e7a2c64ecea3747ae29282d89
SHA1 3266d8e7fd2eb762dcbcc576b314631208f37117
SHA512 5194b30d554796d93be6e9f62b548510d55d8c88cc2127b7f5ff2bf94080fe90ea51bf48d14448b06ee965eb7f44985976622d14b7ff6995a48ed001b9ab3564
SSDEEP 96:nYkvt1ZOJwpvWMoiVmdeH6+kR/+UWQyV+VDCziEwb:nYkF/+GWMXGR/+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e3901bb704a125e317bbb977017eb8398804abd6515f2db056ac1b4a73282bc9
MD5 efa6429bafc391bc586df513b3398c03
SHA1 d44aa670b7155b8fd9a4dd9337336bedfcd1250f
SHA512 24042ecdde089004f7b120c0fae4ae02751164dbfcc361ac5d32951b6bf627cad375dcd10a1960c54c248605d10e6ddf973986f5e92d3cd8cbfd7322a552e49d
SSDEEP 96:nYk8sQtt1JOJwpvWMoiVmdevuQ1j6KFR/+UWQyV+VD7AiEwb:nYkuz+GWMfuQhVR/+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 509e8e3dbf24d3aa4fa151d34bcd0422e4171fabdd3703001298820bc13ce3dc
MD5 2dacef1eac38c7f31f3b9c9f348019d6
SHA1 674001386faa49069349e46a85d7f2348eb812ef
SHA512 5e5563dd10981bcb7a24f3f1f854de7254763557ab6adf7a1acaad0bfe9145eeaeb4042e396b6a5b8d48f50a4dac0700929fbd3d1dc0f453f08fabd15b87cdb0
SSDEEP 192:eoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBHyej8ze2RUeJT/fnyuSBB:q9iIxuERzA83h09RZxY5hIZbnyuDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_13qjj5i0.c5g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_13qjj5i0.c5g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Redline Crack.rar

Path C:\Users\Admin\Downloads\Redline Crack.rar
Size 8.1MB
SHA256 4e33bacb99e5faef2d9d99dc712dd0b6b053414fafa29a83905e6ccb2afc2eb7
MD5 074ab00a6884e6ae21bd0ec676484c84
SHA1 2ae50e1fe181a80467f5aaca6978857381599e15
SHA512 13bd0745f497749038e032de2735ffff2f879c1eed69a83416c785c1435a4cd3de4e239603b5085eb2ba910fba67a4d5fe1182de5730d1fcd13d1d6b0a3ef129
SSDEEP 196608:k93dKfJ/pim7a2Ml4Ft06p2yRwDqVEOtcY0C8MH2F:O3Yxpir9l4FtR8+7Vtck0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Panel.exe

Path C:\Users\Admin\Downloads\Redline Crack\Redline Crack\Panel\RedLine_20_2\Panel\Panel.exe
Size 181KB
SHA256 74e5079e7eb3e39ecf0f0d2d48a119770100bfd44f7f776a12ec0c25ed5936b8
MD5 d12407c805a128099e2ae7929ec81030
SHA1 d5de8f0adff0d33780d1307ddbaa08c210b21432
SHA512 bc67efe96ef236eec83dbfd6b5258f79c2e99e1454132f75e399fdcede06f4468e355d263c06c507f47dc0c7273b87e99fd142a1f6841d9c56ef318908f8bef1
SSDEEP 3072:c57a7oik07z2eCen5DcryULDzjupLQkBuZD8JsorL7/YIMk:c9goiL2eCe5Dcf6zcozgt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Panel.exe.config

Path C:\Users\Admin\Downloads\Redline Crack\Redline Crack\Panel\RedLine_20_2\Panel\Panel.exe.config
Size 26KB
SHA256 f2a5a06359713226aeacfe239eeb8ae8606f4588d8e58a19947c3a190efbdfc7
MD5 494890d393a5a8c54771186a87b0265e
SHA1 162fa5909c1c3f84d34bda5d3370a957fe58c9c8
SHA512 40fbd033f288fee074fc36e899796efb30d3c582784b834fc583706f19a0b8d5a134c6d1405afe563d2676072e4eefc4e169b2087867cab77a3fa1aa1a7c9395
SSDEEP 384:TXe7J7+7m7B7x7e7VCKrfqvUWCBrfqvfVCBrfqvfY:b+U+4+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

serviceSettings.json

Path C:\Users\Admin\Downloads\Redline Crack\Redline Crack\Panel\RedLine_20_2\Panel\serviceSettings.json
Size 75B
SHA256 05c266dd295ef1cf95e0e0c9ccc297a627a62639b38e11bb20069a26563e236e
MD5 12ca7cfe13766e9c7c9a668e88b17fe5
SHA1 25d6527da0d115e41946d55ad258c85af9b0090f
SHA512 582628bc2ba5d93adf41191eafb4e4286a508de6c515fb637c76ba893dfef44241e0023e849404a7e7272bd69ab58fb01a2d8b16f7f8716c8c82a4c109bc6178
MD5 SHA1 SHA512

Submit Download

memory/1684-248-0x0000000005BF0000-0x0000000005C66000-memory.dmp

Download

memory/1684-244-0x0000000000F30000-0x0000000000F64000-memory.dmp

Download

memory/1684-247-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Download

memory/1684-245-0x0000000005FC0000-0x0000000006564000-memory.dmp

Download

memory/1684-249-0x0000000005B90000-0x0000000005BB2000-memory.dmp

Download

memory/1684-250-0x0000000005C90000-0x0000000005CAE000-memory.dmp

Download

memory/1684-246-0x0000000005950000-0x00000000059E2000-memory.dmp

Download

memory/2732-252-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2732-274-0x0000000005520000-0x000000000562A000-memory.dmp

Download

memory/2732-272-0x00000000052B0000-0x00000000052FC000-memory.dmp

Download

memory/2732-256-0x0000000005960000-0x0000000005F78000-memory.dmp

Download

memory/2732-257-0x0000000005210000-0x0000000005222000-memory.dmp

Download

memory/2732-258-0x0000000005270000-0x00000000052AC000-memory.dmp

Download

memory/3952-259-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Download

memory/3952-266-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/3952-265-0x0000000005070000-0x00000000050D6000-memory.dmp

Download

memory/3952-268-0x00000000058D0000-0x0000000005C24000-memory.dmp

Download

memory/3952-255-0x0000000005180000-0x00000000057A8000-memory.dmp

Download

memory/3952-273-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/3952-254-0x0000000002570000-0x00000000025A6000-memory.dmp

Download

memory/3952-275-0x0000000006400000-0x0000000006496000-memory.dmp

Download

memory/3952-276-0x0000000006380000-0x000000000639A000-memory.dmp

Download

memory/3952-277-0x00000000063D0000-0x00000000063F2000-memory.dmp

Download