redline | 2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7

General

Target

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe
Size

2.7MB
MD5

a3a55457b08e66b8246b3ab4f5afc5f8
SHA1

bcfbda193b0091361b4a9ddb06717e219a389351
SHA256

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7
SHA512

b61f2d8f84ee90fd08e057cbdb52df0881998b108f1affa156e0250458cef70007a954ae7913129883f46dcb29e5e697e17cbecef835e6c2378cca080a8d7743
SSDEEP

12288:mJZ7RmT35hppmYbhFD4IssrqUIb231sarW:mZA5hpZFFDtpIb23CarW

Score

10^/10

redline sectoprat biss infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

biss

C2

172.81.131.198:16383

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2364-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2364-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2364-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2364-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2364-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2364-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2364-14-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2364-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2364-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2364-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe

description pid process target process

PID 844 set thread context of 2364 844 2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe jsc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jsc.exe

pid process

2364 jsc.exe
2364 jsc.exe

description	pid	process	target process
PID 844 set thread context of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe

pid	process
2364	jsc.exe
2364	jsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exejsc.exe

description	pid	process
Token: SeDebugPrivilege	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe
Token: SeDebugPrivilege	2364	jsc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe

description	pid	process	target process
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 2364	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	jsc.exe
PID 844 wrote to memory of 680	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	WerFault.exe
PID 844 wrote to memory of 680	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	WerFault.exe
PID 844 wrote to memory of 680	844	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe
"C:\Users\Admin\AppData\Local\Temp\2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 844 -s 616
2⤵
PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/844-1-0x0000000000F30000-0x0000000000F3E000-memory.dmp

Filesize
56KB

Download
memory/844-2-0x000000001B120000-0x000000001B12E000-memory.dmp

Filesize
56KB

Download
memory/844-3-0x0000000000B60000-0x0000000000BD0000-memory.dmp

Filesize
448KB

Download
memory/844-4-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/844-35-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/844-34-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/2364-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2364-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2364-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2364-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2364-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2364-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2364-19-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/2364-20-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-33-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2364-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads