redline | 85bf96314581e45de5f79e617c38c6f321190bb994ca039a14ee36ed1307e884

General

Target

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
Size

530KB
MD5

11cb1c9dd9db7c709a4d33330e878311
SHA1

c16bc7021ba3db3b9b7d257ba4f8060cc2e11d7e
SHA256

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596
SHA512

8e0ffffbbd5b713e1631f9dba93166977d849e420056ae665c92d5e589b49ba1f827f9db83ccbd0fdbf81dfff34c3d8221c3007d67ac6d833ff7dc522074a420
SSDEEP

12288:E49QjSANT3ukfZ7mXGsmFbW7jgJabgX2bIJQeLLW:E4ajFT3ukoXNmFIUJ

Score

10^/10

redline sectoprat cheat infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.171:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/648-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/648-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/648-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/648-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/648-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/648-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/648-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/648-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/648-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/648-17-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

description	pid	process	target process
PID 2116 set thread context of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

pid	process
2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exeb1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

description	pid	process
Token: SeDebugPrivilege	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
Token: SeDebugPrivilege	648	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

description	pid	process	target process
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
PID 2116 wrote to memory of 648	2116	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe	b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe

C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
"C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe
"C:\Users\Admin\AppData\Local\Temp\b1dbe37d7e430630d1806b9cf40e71f3e1c0865892b9f5a74ff7dff422817596.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/648-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/648-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/648-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/648-22-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/648-21-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/648-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/648-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/648-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/648-23-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/648-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2116-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2116-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x00000000013A0000-0x000000000142A000-memory.dmp

Filesize
552KB

Download
memory/2116-6-0x0000000005980000-0x00000000059E0000-memory.dmp

Filesize
384KB

Download
memory/2116-20-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/2116-5-0x00000000002F0000-0x00000000002FC000-memory.dmp

Filesize
48KB

Download
memory/2116-4-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/2116-3-0x0000000000440000-0x000000000045A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads