redline | 45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa

General

Target

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
Size

963KB
MD5

1cc7ec4c91b811c75bb9621120b95dd4
SHA1

214a6276da8f2ead192d1cb28cf6afd514752eec
SHA256

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa
SHA512

af62907155401baa25eb4bfd793ac8cdca1eeb16e030c3c1eb9418b6e1abbea4438c8beea5579e8130b4a4277cad06263a52d080e8e7cc8b9c4221c94fa9d8f0
SSDEEP

24576:KAHnh+eWsN3skA4RV1Hom2KXMmHaHfbSH5:dh+ZkldoPK8YaHf2

Score

10^/10

redline sectoprat windows infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

Windows

C2

95.211.6.240:57887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/716-30-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline
behavioral1/memory/716-39-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline
behavioral1/memory/716-36-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline
behavioral1/memory/716-32-0x0000000000090000-0x00000000000AE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/716-30-0x0000000000090000-0x00000000000AE000-memory.dmp	family_sectoprat
behavioral1/memory/716-39-0x0000000000090000-0x00000000000AE000-memory.dmp	family_sectoprat
behavioral1/memory/716-36-0x0000000000090000-0x00000000000AE000-memory.dmp	family_sectoprat
behavioral1/memory/716-32-0x0000000000090000-0x00000000000AE000-memory.dmp	family_sectoprat

Drops startup file 1 IoCs

Processes:

name.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe
Executes dropped EXE 1 IoCs

Processes:

name.exe

pid process

2496 name.exe
Loads dropped DLL 1 IoCs

Processes:

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe

pid process

1640 45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

pid	process
2496	name.exe

pid	process
1640	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\directory\name.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

name.exe

description pid process target process

PID 2496 set thread context of 716 2496 name.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

716 RegSvcs.exe
716 RegSvcs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

name.exe

pid process

2496 name.exe
2496 name.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 716 RegSvcs.exe

description	pid	process	target process
PID 2496 set thread context of 716	2496	name.exe	RegSvcs.exe

pid	process
716	RegSvcs.exe
716	RegSvcs.exe

pid	process
2496	name.exe
2496	name.exe

description	pid	process
Token: SeDebugPrivilege	716	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exename.exe

description	pid	process	target process
PID 1640 wrote to memory of 2496	1640	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 1640 wrote to memory of 2496	1640	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 1640 wrote to memory of 2496	1640	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 1640 wrote to memory of 2496	1640	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe
PID 2496 wrote to memory of 716	2496	name.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640

C:\Users\Admin\AppData\Local\directory\name.exe
"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pluffer

Filesize
95KB

MD5
1e723f33e03e1277387611f4a3210486

SHA1
0f0e06fd1746d354f4aa911c13bc94883dad0802

SHA256
4551ac7e0c90c688a6578076e1f02a86e03b7bcf1267bcf56a224812ba74325c

SHA512
ddd96de4f849900c873099e26facb7012c97d02ff7d4a69fa5aa36b7d47b1d1b69998b3efc39bd1f6b914e428f267e73688a55e1f9591d2f2c95d9910ce3eb24

Download Submit
C:\Users\Admin\AppData\Local\Temp\rhombiform

Filesize
28KB

MD5
67d670d3b068b63cdd70a63349c0b52e

SHA1
8f1359857bc484258119762622c878c282eaef7b

SHA256
1e5b35e0dac4be6ec5f69973f8292a79032f04a61e9c5803ee1ed76a5f339213

SHA512
e563f2ccc25cedaefe7dbd73460af353f7f098f22a9b618845f439789845fa3bd1ee793eba615939aa3e468e1b6b571ca5323559acd83484987a6c7d1e115f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF402.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF417.tmp

Filesize
92KB

MD5
de7d702f13db499233da2c87959d7696

SHA1
8d51283dc6b41cae89ac01928cd0460604ff1d3e

SHA256
78e689d13f1ff71daeb36634831fa7457a8c90ea465a3e342aef921d8ca82b34

SHA512
a57e198ff5e32453ac99d6aefb5ab71f9cb4c80006f2a75d3c3e0ef28a0ca00f387110788edc1df1e0a7ab9a2503571e82749e51acf7c67e654a586503754045

Download Submit
C:\Users\Admin\AppData\Local\directory\name.exe

Filesize
963KB

MD5
1cc7ec4c91b811c75bb9621120b95dd4

SHA1
214a6276da8f2ead192d1cb28cf6afd514752eec

SHA256
45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa

SHA512
af62907155401baa25eb4bfd793ac8cdca1eeb16e030c3c1eb9418b6e1abbea4438c8beea5579e8130b4a4277cad06263a52d080e8e7cc8b9c4221c94fa9d8f0

Download Submit
memory/716-36-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/716-32-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/716-40-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/716-41-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/716-39-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/716-30-0x0000000000090000-0x00000000000AE000-memory.dmp

Filesize
120KB

Download
memory/716-126-0x000000007451E000-0x000000007451F000-memory.dmp

Filesize
4KB

Download
memory/716-127-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/716-128-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/1640-10-0x0000000000110000-0x0000000000114000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads