redline | b250fb4824c4ebf1071d947e78852446e431b5eb0a74d9406237a7b9e81972b5

General

Target

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
Size

963KB
MD5

1cc7ec4c91b811c75bb9621120b95dd4
SHA1

214a6276da8f2ead192d1cb28cf6afd514752eec
SHA256

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa
SHA512

af62907155401baa25eb4bfd793ac8cdca1eeb16e030c3c1eb9418b6e1abbea4438c8beea5579e8130b4a4277cad06263a52d080e8e7cc8b9c4221c94fa9d8f0
SSDEEP

24576:KAHnh+eWsN3skA4RV1Hom2KXMmHaHfbSH5:dh+ZkldoPK8YaHf2

Score

10^/10

redline sectoprat windows infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

Windows

C2

95.211.6.240:57887

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2680-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2680-34-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2680-32-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2680-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2680-34-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2680-32-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Drops startup file 1 IoCs

Processes:

name.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe
Executes dropped EXE 1 IoCs

Processes:

name.exe

pid process

2976 name.exe
Loads dropped DLL 1 IoCs

Processes:

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe

pid process

1988 45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

pid	process
2976	name.exe

pid	process
1988	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\directory\name.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

name.exe

description pid process target process

PID 2976 set thread context of 2680 2976 name.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2680 RegSvcs.exe
2680 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

name.exe

pid process

2976 name.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2680 RegSvcs.exe

description	pid	process	target process
PID 2976 set thread context of 2680	2976	name.exe	RegSvcs.exe

pid	process
2680	RegSvcs.exe
2680	RegSvcs.exe

pid	process
2976	name.exe

description	pid	process
Token: SeDebugPrivilege	2680	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exename.exe

description	pid	process	target process
PID 1988 wrote to memory of 2976	1988	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 1988 wrote to memory of 2976	1988	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 1988 wrote to memory of 2976	1988	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 1988 wrote to memory of 2976	1988	45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe	name.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe
PID 2976 wrote to memory of 2680	2976	name.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe
"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\directory\name.exe
"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pluffer

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\rhombiform

Filesize
28KB

MD5
67d670d3b068b63cdd70a63349c0b52e

SHA1
8f1359857bc484258119762622c878c282eaef7b

SHA256
1e5b35e0dac4be6ec5f69973f8292a79032f04a61e9c5803ee1ed76a5f339213

SHA512
e563f2ccc25cedaefe7dbd73460af353f7f098f22a9b618845f439789845fa3bd1ee793eba615939aa3e468e1b6b571ca5323559acd83484987a6c7d1e115f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp241C.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2432.tmp

Filesize
92KB

MD5
f4043b9b54cb32b738ca265397e3fa05

SHA1
0ee24b3f338b66b3a9f87d2fe4920759f1849cda

SHA256
fdbc98007cc9a5c7497e088ffb8841c857d924fa4104bd77ecfff7e917342500

SHA512
6b46b0faf55d927c0cfa46a05dc554036992c83e2a4ff47867f2b3dda16c7d4b184514532c88a7c3457de7d19712e07ed3b650de991871a13c0058be1d84496f

Download Submit
\Users\Admin\AppData\Local\directory\name.exe

Filesize
963KB

MD5
1cc7ec4c91b811c75bb9621120b95dd4

SHA1
214a6276da8f2ead192d1cb28cf6afd514752eec

SHA256
45546f324eb60085374045715890404ffe9ecbd9c15cbcfcb6828fdfd87179fa

SHA512
af62907155401baa25eb4bfd793ac8cdca1eeb16e030c3c1eb9418b6e1abbea4438c8beea5579e8130b4a4277cad06263a52d080e8e7cc8b9c4221c94fa9d8f0

Download Submit
memory/1988-10-0x00000000000A0000-0x00000000000A4000-memory.dmp

Filesize
16KB

Download
memory/2680-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2680-34-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2680-32-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2680-35-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/2680-36-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download
memory/2680-115-0x0000000074720000-0x0000000074E0E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads