redline | 85bf96314581e45de5f79e617c38c6f321190bb994ca039a14ee36ed1307e884

General

Target

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
Size

530KB
MD5

11cb1c9dd9db7c709a4d33330e878311
SHA1

c16bc7021ba3db3b9b7d257ba4f8060cc2e11d7e
SHA256

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596
SHA512

8e0ffffbbd5b713e1631f9dba93166977d849e420056ae665c92d5e589b49ba1f827f9db83ccbd0fdbf81dfff34c3d8221c3007d67ac6d833ff7dc522074a420
SSDEEP

12288:E49QjSANT3ukfZ7mXGsmFbW7jgJabgX2bIJQeLLW:E4ajFT3ukoXNmFIUJ

Score

10^/10

redline sectoprat cheat infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.171:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1924-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1924-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1924-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1924-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1924-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1924-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1924-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1924-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1924-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/1924-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

description	pid	process	target process
PID 2096 set thread context of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

pid	process
2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exeb1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

description	pid	process
Token: SeDebugPrivilege	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
Token: SeDebugPrivilege	1924	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

description	pid	process	target process
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2096 wrote to memory of 1924	2096	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
"C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096

C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
"C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1924-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1924-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1924-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1924-24-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-22-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1924-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1924-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1924-25-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1924-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2096-2-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/2096-0-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000000B60000-0x0000000000BEA000-memory.dmp

Filesize
552KB

Download
memory/2096-6-0x0000000002140000-0x00000000021A0000-memory.dmp

Filesize
384KB

Download
memory/2096-5-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2096-23-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/2096-4-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/2096-3-0x0000000000690000-0x00000000006AA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads