redline | 308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da

General

Target

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
Size

537KB
MD5

84f5b3c949133a8b140ddf29599ac108
SHA1

1aa1de829120ade730a73eae45a148d7e7b522de
SHA256

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da
SHA512

688480999735b4b8fef83d7acd35313f7674b850dc984c887deed3716317dcfefe56092a179ca2e22950272a31dfd13fcf243ecb49461d1a65469a0b59652390
SSDEEP

12288:giN882BwZOvQkoheFfZu8uxZ9scbdOroNWlfH79d1vk8kR:gu2BAlkJxur9scpOroklfHBS

Score

10^/10

redline sectoprat cheat credential_access discovery execution infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.57.151:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2576-27-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2576-24-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2576-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2576-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2576-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2576-27-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2576-24-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2576-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2576-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2576-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2836 powershell.exe
2656 powershell.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2836	powershell.exe
2656	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

description	pid	process	target process
PID 2972 set thread context of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exepowershell.exeschtasks.exepowershell.exe308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2760 schtasks.exe

pid	process
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exepowershell.exepowershell.exe308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

pid	process
2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
2656	powershell.exe
2836	powershell.exe
2576	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
2576	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exepowershell.exepowershell.exe308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

description	pid	process
Token: SeDebugPrivilege	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2576	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

description	pid	process	target process
PID 2972 wrote to memory of 2836	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2836	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2836	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2836	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2656	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2656	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2656	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2656	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	powershell.exe
PID 2972 wrote to memory of 2760	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	schtasks.exe
PID 2972 wrote to memory of 2760	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	schtasks.exe
PID 2972 wrote to memory of 2760	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	schtasks.exe
PID 2972 wrote to memory of 2760	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	schtasks.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
PID 2972 wrote to memory of 2576	2972	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe	308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe

C:\Users\Admin\AppData\Local\Temp\308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
"C:\Users\Admin\AppData\Local\Temp\308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iuJxYUb.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iuJxYUb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1FD0.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Users\Admin\AppData\Local\Temp\308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe
"C:\Users\Admin\AppData\Local\Temp\308fe509004ed6173a190ea8c1813dd729e44c510468f8128083b33d2a8ce7da.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1FD0.tmp
Filesize
1KB

MD5
c66a4bc1831f7354685196eda4026f42

SHA1
78ad62f0ff974b077455a3e3e10e3c143f96d5e9

SHA256
ea632d51b85790fa0f64c3eda6a74806fa6664a62a8bd73aaf2e67abb31f4c26

SHA512
86d0699c7f73e8a2a0af94c926665534d6e3e172139bcbd17fbd251edf369c54d59f40ad308b4b4e41175a5fda3a7bba741ca980b112cd455ddb24c358947f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp490B.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4920.tmp
Filesize
92KB

MD5
2c87b2d541eecd3b4a69f502e63a5783

SHA1
c3d1777df678cf4ef89ec8330f4d64f07fb26f9e

SHA256
eae2daadf140785ff98f48909f57ec24b3138fc0744018ec84a4ff8932c3d638

SHA512
502bd68d3ead4d794969b1db7dde114e0d3ded7fc52d81ab4e50c9d59ba74a0279426b54502301e2589929802b91ff8aa32d7e3d02a79d98209e540b40f7304c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
00400e5cb83434f775d1cdaeca617d4f

SHA1
d8de4eed764d8a69026e5ae00fe83eee0a553123

SHA256
d971951653fe84908b538b7d1b2edc00b7d1967c7d46eb468d62993d5481c357

SHA512
e0d2f86d7ae674bf5628f3158c4b48cdc1e16364d724b4410a4f52aa0d3ba1ba059eb5ccf7759c173730921678ccd3fe7e21373006d5b0a089124b6c21de546b

Download Submit
memory/2576-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2576-24-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2576-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2576-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2576-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2576-27-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2576-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2972-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2972-5-0x00000000010F0000-0x0000000001150000-memory.dmp

Filesize
384KB

Download
memory/2972-3-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/2972-4-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/2972-30-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2972-2-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2972-1-0x0000000001370000-0x00000000013F8000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads