redline | 2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7

General

Target

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe
Size

2.7MB
MD5

a3a55457b08e66b8246b3ab4f5afc5f8
SHA1

bcfbda193b0091361b4a9ddb06717e219a389351
SHA256

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7
SHA512

b61f2d8f84ee90fd08e057cbdb52df0881998b108f1affa156e0250458cef70007a954ae7913129883f46dcb29e5e697e17cbecef835e6c2378cca080a8d7743
SSDEEP

12288:mJZ7RmT35hppmYbhFD4IssrqUIb231sarW:mZA5hpZFFDtpIb23CarW

Score

10^/10

redline sectoprat biss infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

biss

C2

172.81.131.198:16383

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4748-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4748-5-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe

description	pid	process	target process
PID 4548 set thread context of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

installutil.exe

pid process

4748 installutil.exe
4748 installutil.exe

pid	process
4748	installutil.exe
4748	installutil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exeinstallutil.exe

description	pid	process
Token: SeDebugPrivilege	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe
Token: SeDebugPrivilege	4748	installutil.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe

description	pid	process	target process
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe
PID 4548 wrote to memory of 4748	4548	2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe	installutil.exe

C:\Users\Admin\AppData\Local\Temp\2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe
"C:\Users\Admin\AppData\Local\Temp\2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4548-10-0x00007FFC06AB0000-0x00007FFC07571000-memory.dmp

Filesize
10.8MB

Download
memory/4548-1-0x00007FFC06AB3000-0x00007FFC06AB5000-memory.dmp

Filesize
8KB

Download
memory/4548-2-0x000002A56AD90000-0x000002A56AD9E000-memory.dmp

Filesize
56KB

Download
memory/4548-3-0x000002A56AC40000-0x000002A56ACB0000-memory.dmp

Filesize
448KB

Download
memory/4548-4-0x00007FFC06AB0000-0x00007FFC07571000-memory.dmp

Filesize
10.8MB

Download
memory/4548-0-0x000002A568810000-0x000002A56881E000-memory.dmp

Filesize
56KB

Download
memory/4748-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4748-15-0x0000000006F20000-0x000000000744C000-memory.dmp

Filesize
5.2MB

Download
memory/4748-8-0x00000000054B0000-0x00000000054C2000-memory.dmp

Filesize
72KB

Download
memory/4748-9-0x0000000005510000-0x000000000554C000-memory.dmp

Filesize
240KB

Download
memory/4748-6-0x00000000751AE000-0x00000000751AF000-memory.dmp

Filesize
4KB

Download
memory/4748-11-0x0000000005570000-0x00000000055BC000-memory.dmp

Filesize
304KB

Download
memory/4748-12-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/4748-13-0x00000000057C0000-0x00000000058CA000-memory.dmp

Filesize
1.0MB

Download
memory/4748-14-0x0000000006820000-0x00000000069E2000-memory.dmp

Filesize
1.8MB

Download
memory/4748-7-0x0000000005B90000-0x00000000061A8000-memory.dmp

Filesize
6.1MB

Download
memory/4748-16-0x00000000069F0000-0x0000000006A82000-memory.dmp

Filesize
584KB

Download
memory/4748-17-0x0000000006A90000-0x0000000006B06000-memory.dmp

Filesize
472KB

Download
memory/4748-18-0x0000000007A00000-0x0000000007FA4000-memory.dmp

Filesize
5.6MB

Download
memory/4748-19-0x0000000006CE0000-0x0000000006CFE000-memory.dmp

Filesize
120KB

Download
memory/4748-20-0x00000000078E0000-0x0000000007946000-memory.dmp

Filesize
408KB

Download
memory/4748-54-0x00000000751AE000-0x00000000751AF000-memory.dmp

Filesize
4KB

Download
memory/4748-56-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads