redline | 9ad8a7c40f6360a17fa6a3d50bb25e97e87b042a6ae1555d089e32f0ab6d08a8

General

Target

24a0fca0ed4e41562a676366af495f6a.exe
Size

641KB
MD5

24a0fca0ed4e41562a676366af495f6a
SHA1

16fcc47dee4d1aa73911dfe855e2053a27df176a
SHA256

9ad8a7c40f6360a17fa6a3d50bb25e97e87b042a6ae1555d089e32f0ab6d08a8
SHA512

8d45ac314acb1ce1cd84fa0fcf157be39a01fbc51beb7a4b1412a250156a00018bbdfcc73226b4b1d9229b5c66b8402e605339b0dcc82681c6406e86debd5ed3
SSDEEP

12288:QLH14GB65SbH8SLGjnlDENFTHzJXKc9cbehZDkR:i2SUnCNFTHzBcQZW

Score

10^/10

redline sectoprat cheat execution infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.57.74:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2964-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2964-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2964-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2964-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2964-32-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2964-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2964-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2964-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2964-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2964-32-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2452 powershell.exe
2796 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

24a0fca0ed4e41562a676366af495f6a.exe

description pid process target process

PID 2084 set thread context of 2964 2084 24a0fca0ed4e41562a676366af495f6a.exe 24a0fca0ed4e41562a676366af495f6a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2892 schtasks.exe

pid	process
2452	powershell.exe
2796	powershell.exe

description	pid	process	target process
PID 2084 set thread context of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe

pid	process
2892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

24a0fca0ed4e41562a676366af495f6a.exepowershell.exepowershell.exe

pid	process
2084	24a0fca0ed4e41562a676366af495f6a.exe
2084	24a0fca0ed4e41562a676366af495f6a.exe
2084	24a0fca0ed4e41562a676366af495f6a.exe
2084	24a0fca0ed4e41562a676366af495f6a.exe
2796	powershell.exe
2452	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

24a0fca0ed4e41562a676366af495f6a.exepowershell.exepowershell.exe24a0fca0ed4e41562a676366af495f6a.exe

description	pid	process
Token: SeDebugPrivilege	2084	24a0fca0ed4e41562a676366af495f6a.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2964	24a0fca0ed4e41562a676366af495f6a.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

24a0fca0ed4e41562a676366af495f6a.exe

description	pid	process	target process
PID 2084 wrote to memory of 2452	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2452	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2452	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2452	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2796	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2796	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2796	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2796	2084	24a0fca0ed4e41562a676366af495f6a.exe	powershell.exe
PID 2084 wrote to memory of 2892	2084	24a0fca0ed4e41562a676366af495f6a.exe	schtasks.exe
PID 2084 wrote to memory of 2892	2084	24a0fca0ed4e41562a676366af495f6a.exe	schtasks.exe
PID 2084 wrote to memory of 2892	2084	24a0fca0ed4e41562a676366af495f6a.exe	schtasks.exe
PID 2084 wrote to memory of 2892	2084	24a0fca0ed4e41562a676366af495f6a.exe	schtasks.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe
PID 2084 wrote to memory of 2964	2084	24a0fca0ed4e41562a676366af495f6a.exe	24a0fca0ed4e41562a676366af495f6a.exe

C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe
"C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pCchvpbATSqSt.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pCchvpbATSqSt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDAD5.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe
"C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDAD5.tmp
Filesize
1KB

MD5
3d314c82d579530ad60bd389e5e679ec

SHA1
0b3084e2ead2e88219503fdc57fe2d6d054a2acc

SHA256
943c6394262c0e2fe692a295518be46ac33fdfb5a618bd680b694753f99741a9

SHA512
e63ac11c2dfef5e26ce3f254f2886ed340dc8679f600e10b49207e489f476a32cfe4b56d4c945bc6f8843be61fda69fd3bbf2f4e36aa6eb13de433b0c7e53a9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
f3f88e1de04f1257f3d5376931a9838e

SHA1
0928a25f0d0f0e8b2318787a0873376da8f8edb5

SHA256
5d7ffb682190622b33ed32548c6e1f398cbe5a54b6f44a1431ad32da0bc7c0a5

SHA512
23b7fd6fa5bbbc4360917939826ffb796873c33317e84cebe25ff078d7440d3dc021fed5de1b4a42fdc78d438914e8d1d254bd70a8410e8e6f7f0d92fd123658

Download Submit
memory/2084-4-0x00000000007C0000-0x00000000007C8000-memory.dmp

Filesize
32KB

Download
memory/2084-29-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2084-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/2084-5-0x00000000007D0000-0x00000000007DE000-memory.dmp

Filesize
56KB

Download
memory/2084-6-0x0000000004820000-0x0000000004880000-memory.dmp

Filesize
384KB

Download
memory/2084-2-0x00000000747C0000-0x0000000074EAE000-memory.dmp

Filesize
6.9MB

Download
memory/2084-1-0x0000000000BB0000-0x0000000000C50000-memory.dmp

Filesize
640KB

Download
memory/2084-3-0x00000000004D0000-0x00000000004E2000-memory.dmp

Filesize
72KB

Download
memory/2964-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2964-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2964-32-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads