redline | 1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d

General

Target

Yc3OSkUSm5dLQY906NXrU_Xf.exe
Size

589KB
MD5

34c76bcc1506b513c7a1ac605c045c4e
SHA1

271c6b3853e33e039242da7cf8f4465c48e90d2e
SHA256

1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d
SHA512

cb2170b5fa492dcb7df54cfd7f4ad94214de98face0f1710cbad749c79bf322ea1106ace723520486bdeabdf0aa2eefbf70dcc060d61fcda1124298225c36865
SSDEEP

12288:fhdKHkwkYGXXRJRC7ijHRAWteLwnHdYnXQ6mr4ZFrUD:fzKYQv

Score

10^/10

redline sectoprat 23.08 infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

23.08

C2

95.181.172.100:55640

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2304-9-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/2304-13-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/2304-11-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/2304-6-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/2304-5-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2304-9-0x0000000000400000-0x0000000000420000-memory.dmp	family_sectoprat
behavioral1/memory/2304-13-0x0000000000400000-0x0000000000420000-memory.dmp	family_sectoprat
behavioral1/memory/2304-11-0x0000000000400000-0x0000000000420000-memory.dmp	family_sectoprat
behavioral1/memory/2304-6-0x0000000000400000-0x0000000000420000-memory.dmp	family_sectoprat
behavioral1/memory/2304-5-0x0000000000400000-0x0000000000420000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 1 IoCs

Processes:

Yc3OSkUSm5dLQY906NXrU_Xf.exe

description pid process target process

PID 2088 set thread context of 2304 2088 Yc3OSkUSm5dLQY906NXrU_Xf.exe Yc3OSkUSm5dLQY906NXrU_Xf.exe

description	pid	process	target process
PID 2088 set thread context of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Yc3OSkUSm5dLQY906NXrU_Xf.exe

description	pid	process	target process
PID 2088 wrote to memory of 3068	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 3068	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 3068	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 3068	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe
PID 2088 wrote to memory of 2304	2088	Yc3OSkUSm5dLQY906NXrU_Xf.exe	Yc3OSkUSm5dLQY906NXrU_Xf.exe

C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe
"C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe
C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe
2⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe
C:\Users\Admin\AppData\Local\Temp\Yc3OSkUSm5dLQY906NXrU_Xf.exe
2⤵
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-0-0x000000007427E000-0x000000007427F000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x0000000000030000-0x00000000000CA000-memory.dmp

Filesize
616KB

Download
memory/2088-2-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2088-14-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2304-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-15-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-16-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-17-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-18-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads