redline | a86d97fe008bfeb8568930bfa03e0057f77b0c8a46048ff011af244bfcefee59

Resubmissions

29-07-2024 20:42

240729-zhay8atfmb 10

26-07-2024 11:22

240726-ng188sycjb 10

25-07-2024 05:05

240725-fqw2watble 10

Analysis

max time kernel
111s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ-SW M-0013091-DHABI HARDWARE.exe
Size

24KB
MD5

9f6938e89824ccce04a9272087dec776
SHA1

7f19bee228698f4b0bb90b40c6ca2bcadc326a66
SHA256

b500874cd5939223c2b7cb52134bef3a3bf6ab1c1d112bf27c6b5e5b15f8177f
SHA512

e0052a1bcf5d5ab910da6541c51338e1215a265e8521260bf08ab00ac0320653dafab565ef616d7f1192fb55d4b0feb1666b1a73fcc7b08ae0ac0e625f4b67e1
SSDEEP

384:eM4cghl1oqCrKFf4H5A2eFP27xWkVbgWUlIx4cNWcG0FP27NBY3Yuv+ivM:WSqbFQH5iKxnVbgvqxNNZK/Y/+

Score

10^/10

redline sectoprat lovato credential_access discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lovato

57.128.132.216:55123

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4740-0-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4740-0-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 5 IoCs

Processes:

RFQ-SW M-0013091-DHABI HARDWARE.exe

description	pid	process	target process
PID 2768 set thread context of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 set thread context of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 set thread context of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 set thread context of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 set thread context of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2468 4740 WerFault.exe regsvcs.exe

pid	pid_target	process	target process
2468	4740	WerFault.exe	regsvcs.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

CasPol.exeCasPol.exeinstallutil.exeCasPol.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

CasPol.exeCasPol.exeCasPol.exeinstallutil.exe

pid	process
3084	CasPol.exe
3084	CasPol.exe
3084	CasPol.exe
2000	CasPol.exe
2000	CasPol.exe
3924	CasPol.exe
3924	CasPol.exe
2552	installutil.exe
2552	installutil.exe
3924	CasPol.exe
2000	CasPol.exe
2552	installutil.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

CasPol.exeinstallutil.exeCasPol.exeCasPol.exe

description	pid	process
Token: SeDebugPrivilege	2000	CasPol.exe
Token: SeDebugPrivilege	2552	installutil.exe
Token: SeDebugPrivilege	3924	CasPol.exe
Token: SeDebugPrivilege	3084	CasPol.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

RFQ-SW M-0013091-DHABI HARDWARE.exe

description	pid	process	target process
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 4740	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	regsvcs.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3084	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 3924	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2868	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	jsc.exe
PID 2768 wrote to memory of 2868	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	jsc.exe
PID 2768 wrote to memory of 2868	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	jsc.exe
PID 2768 wrote to memory of 2868	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	jsc.exe
PID 2768 wrote to memory of 2868	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	jsc.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2552	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	installutil.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe
PID 2768 wrote to memory of 2000	2768	RFQ-SW M-0013091-DHABI HARDWARE.exe	CasPol.exe

C:\Users\Admin\AppData\Local\Temp\RFQ-SW M-0013091-DHABI HARDWARE.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-SW M-0013091-DHABI HARDWARE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
2⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 160
3⤵
- Program crash
PID:2468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
PID:2868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4740 -ip 4740
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CasPol.exe.log

Filesize
2KB

MD5
c0ced3fd9b42a0142448d507f6a4c2af

SHA1
cb66ee9d9920cc61bb982709c15e448bc45de0a9

SHA256
1af3fb7e6be9a8ddfaddc28f4f2d4cf99f1fa06d57747ec1d8b1442bb2785037

SHA512
1a655235898051f13a58d417b284c51746f5acbe6fd5e7de74d537bfdf14b44e978e6581b8872c0d790d8048ad8836ea8b8be805fb993e2852301620dad92100

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB14E.tmp

Filesize
17KB

MD5
f83bb869aebb7c7ab40c286a111d8bf8

SHA1
2a782a5c2087eefc7a7f523f6e655dca7c870a67

SHA256
bbe3d9dc0bb52126b8499338f398655dfe874caaf1b77a2feffc36fce58bd038

SHA512
8ec54939f4d61bd77049fe31ce724cb0901283e19ffe8c91798ee395ab8cea28893b6b02935048cce0fdfff9478375549fa8f4f019652713f16d924bf5c5afcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB14F.tmp

Filesize
13KB

MD5
b01594cc98ea1388f65becfe5fd11d91

SHA1
cc17124e2b4f34d25518325cc6269a65883d296a

SHA256
fe0b97a0744caf3a9d4ecb7b84ec58051aca56dc8daabc2c499b55757ed3967c

SHA512
f7a1213381dc3f51504bfd1b6d793f039136f754cdcae056dd68d255abb8f923a44b1c58cef6a29b07529417d23a80295e3b41bf967ab6cd858f99fcd20360c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB160.tmp

Filesize
17KB

MD5
e25aade35e040827a40ca7c50a93e367

SHA1
ec5d6af9b95eb84660940d08d571288b1784f0bd

SHA256
62ae56f5db8abdb3362b611b5dff9479734a5f960ef6f3638c3fcc358108373e

SHA512
743a10760fcc9395caabd6b9169aa7e57b508c328dedd850cc005c23ef3bdfed74d0fa0fbe901ffb417b66e942c245ce3f0191212789ca990215868431e8ac71

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB161.tmp

Filesize
490KB

MD5
6dfa7023a4c8f9e016a0df4e2e745730

SHA1
c04d37a40cac85df6b771b922a0bdfdfb47687ea

SHA256
599ae58acb2952067c37d106ca67aef3d3c6313bc7f8e8121eb6ba8c7e035be6

SHA512
f2ed850ff2e0de693da0d1c123a66cc2d895baa32afe5e60a7fff64fc96a4cc96407dbe600c52693f8c04161f788c50972cb9e39bc30ced9d5f8593d336cf031

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB26D.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB292.tmp

Filesize
114KB

MD5
a2bc4eb3c67f34d75effa9bde49c2ffb

SHA1
f38bf9e1468d1dd11a5d197c8befcbf9302e4e57

SHA256
a2afda6ed0239af2873e61cffb2817572f9f5ce278b509d6c9c9e5f368a178e5

SHA512
30fd383d5b385ffb7f6551ea64636189bfa090a9097e8373574c6dcf3c9e7bbc8c08035057a5565fd139dc505e1ca40cd83df477c2ee67a605d0a2cf8481dffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB2AE.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB2C3.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB2D9.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB304.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
memory/2000-20-0x0000000007290000-0x00000000072AE000-memory.dmp

Filesize
120KB

Download
memory/2000-16-0x0000000006D80000-0x0000000006DE6000-memory.dmp

Filesize
408KB

Download
memory/2000-17-0x0000000007D90000-0x0000000008334000-memory.dmp

Filesize
5.6MB

Download
memory/2000-18-0x00000000070D0000-0x0000000007162000-memory.dmp

Filesize
584KB

Download
memory/2000-19-0x0000000007170000-0x00000000071E6000-memory.dmp

Filesize
472KB

Download
memory/2000-15-0x00000000072B0000-0x00000000077DC000-memory.dmp

Filesize
5.2MB

Download
memory/2000-13-0x0000000005A90000-0x0000000005B9A000-memory.dmp

Filesize
1.0MB

Download
memory/2552-691-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/2552-689-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/2552-11-0x0000000005120000-0x000000000516C000-memory.dmp

Filesize
304KB

Download
memory/2552-8-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/3084-10-0x00000000051E0000-0x000000000521C000-memory.dmp

Filesize
240KB

Download
memory/3084-9-0x0000000005180000-0x0000000005192000-memory.dmp

Filesize
72KB

Download
memory/3084-12-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/3084-7-0x0000000005770000-0x0000000005D88000-memory.dmp

Filesize
6.1MB

Download
memory/3084-686-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/3084-3-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

Filesize
4KB

Download
memory/3924-6-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/3924-688-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/3924-14-0x00000000062C0000-0x0000000006482000-memory.dmp

Filesize
1.8MB

Download
memory/3924-692-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/4740-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download