Malware Analysis Report

2024-09-11 09:46

Sample ID 240706-kxa57staql
Target a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe
SHA256 a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8
Tags
cheat redline sectoprat infostealer rat trojan discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8

Threat Level: Known bad

The file a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe was found to be: Known bad.

Malicious Activity Summary

cheat redline sectoprat infostealer rat trojan discovery spyware stealer

SectopRAT payload

RedLine payload

Redline family

RedLine

SectopRAT

Sectoprat family

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-06 08:58

Signatures

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Sectoprat family

sectoprat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-06 08:58

Reported

2024-07-06 09:00

Platform

win7-20240508-en

Max time kernel

130s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe

"C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe"

Network

Country Destination Domain Proto
NL 161.129.65.145:4483 tcp
NL 161.129.65.145:4483 tcp
NL 161.129.65.145:4483 tcp
NL 161.129.65.145:4483 tcp
NL 161.129.65.145:4483 tcp
NL 161.129.65.145:4483 tcp

Files

memory/2416-0-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

memory/2416-1-0x00000000010E0000-0x00000000010FE000-memory.dmp

memory/2416-2-0x0000000073EB0000-0x000000007459E000-memory.dmp

memory/2416-3-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

memory/2416-4-0x0000000073EB0000-0x000000007459E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-06 08:58

Reported

2024-07-06 09:00

Platform

win10v2004-20240704-en

Max time kernel

124s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe

"C:\Users\Admin\AppData\Local\Temp\a0aae683ab5377405fe6e2df78c2fd51cddb0cfec0c8bf6cca240dd518ed8dc8.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4432,i,18341222626402534844,12352985901844242237,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
NL 161.129.65.145:4483 161.129.65.145 tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 145.65.129.161.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp

Files

memory/2420-0-0x000000007482E000-0x000000007482F000-memory.dmp

memory/2420-1-0x0000000000580000-0x000000000059E000-memory.dmp

memory/2420-2-0x0000000005570000-0x0000000005B88000-memory.dmp

memory/2420-3-0x0000000004F50000-0x0000000004F62000-memory.dmp

memory/2420-4-0x0000000004FB0000-0x0000000004FEC000-memory.dmp

memory/2420-5-0x0000000004FF0000-0x000000000503C000-memory.dmp

memory/2420-6-0x0000000074820000-0x0000000074FD0000-memory.dmp

memory/2420-7-0x0000000005250000-0x000000000535A000-memory.dmp

memory/2420-8-0x0000000006530000-0x00000000066F2000-memory.dmp

memory/2420-9-0x0000000006C30000-0x000000000715C000-memory.dmp

memory/2420-10-0x00000000064C0000-0x0000000006526000-memory.dmp

memory/2420-11-0x0000000007710000-0x0000000007CB4000-memory.dmp

memory/2420-12-0x0000000006950000-0x00000000069E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5502.tmp

MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

C:\Users\Admin\AppData\Local\Temp\tmp5517.tmp

MD5 a146b07d36c77deb545345f9fe3ddd75
SHA1 a0c87bf2dbe1dccdcbd2f68f2c366d273d247192
SHA256 f28113548245d5faa6e48dcbd57e80a29081d017b95808697347619b89d42c9b
SHA512 5cad32cef6e57d99c0e4508ae7f727055b0350a54578b65e1cf7f2fac319c07e32bb931740b4466d343be3c1178cf796067f467a2ccb56d7a60473258ff078cb

C:\Users\Admin\AppData\Local\Temp\tmp5543.tmp

MD5 7872fbf0a1bb518682babda3d8dc7b4e
SHA1 9714d4f9f7e7c3b9a99f656b88b3a10cbd9c65e4
SHA256 a821fa964b5c5273f0e4696e98815f07113c85436cc468f41f39722e7d2767c2
SHA512 f91bb32e1675f822af53ebc91dc5764625b13bc2e365dcf795e1132525857e5d43a18b2f53b4bb70722aef7a0eafd5b3e4d1805f8567d325d34ae41c281832c0

C:\Users\Admin\AppData\Local\Temp\tmp5568.tmp

MD5 d03cf543e1d1e856fecabd08f13c13a3
SHA1 47583c71d1b40c901d381a99a0a7b991d51ba9f6
SHA256 e45195be46787585f4b9009f5da4dea5b528974147224acc20c0aae7d12c0351
SHA512 05740ca1559a8a8bcaddc5eb66976f8697bfd053daa05e43508ac171f6d51d71989ba6288957ebb696d2aa60a2948a7b9137935485b6dc390b6e45b0d6b4c9fa

C:\Users\Admin\AppData\Local\Temp\tmp5593.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/2420-146-0x0000000006B70000-0x0000000006BE6000-memory.dmp

memory/2420-147-0x0000000007160000-0x000000000717E000-memory.dmp

memory/2420-161-0x0000000074820000-0x0000000074FD0000-memory.dmp