redline | 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86

General

Target

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
Size

537KB
MD5

9954659fe9b70868e651001b52d17691
SHA1

f2035cf1739bd6da81328cdf964f739fa9090110
SHA256

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86
SHA512

1ac3216f2c3ff24186f565cef6af8816bcba1d96a2ffa9dc242390852db50fdc0411675618ed1d9ef17054fdab122cc6a91e9857805464d540e93ee83d8746ca
SSDEEP

12288:HuASY+aZrwrZaOTUTpfS9PyzipZlYsbxI9WZw2i:h/4rEOWulpZlHbcWZG

Score

10^/10

redline sectoprat eff123 discovery execution infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

eff123

C2

143.244.169.95:16383

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2660-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2660-31-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2660-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2660-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2660-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2660-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2660-31-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2660-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2660-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2660-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2808 powershell.exe
2264 powershell.exe

pid	process
2808	powershell.exe
2264	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

description	pid	process	target process
PID 2532 set thread context of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exepowershell.exepowershell.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2080 schtasks.exe

pid	process
2080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exepowershell.exepowershell.exe

pid	process
2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
2808	powershell.exe
2264	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exepowershell.exepowershell.exe788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

description	pid	process
Token: SeDebugPrivilege	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2660	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

description	pid	process	target process
PID 2532 wrote to memory of 2808	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2808	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2808	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2808	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2264	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2264	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2264	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2264	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	powershell.exe
PID 2532 wrote to memory of 2080	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	schtasks.exe
PID 2532 wrote to memory of 2080	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	schtasks.exe
PID 2532 wrote to memory of 2080	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	schtasks.exe
PID 2532 wrote to memory of 2080	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	schtasks.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
PID 2532 wrote to memory of 2660	2532	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe	788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
"C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kCpzIBXuOwHQnl.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kCpzIBXuOwHQnl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFA5.tmp"
2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
"C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDFA5.tmp

Filesize
1KB

MD5
a4b338c6648c85dbe54b54c2027d1576

SHA1
a132f78620f2d972fc1437c26cacab6ff4bfd2d3

SHA256
ebb118d1943ab5841cf6addc55383f9a7d409347fa8f4b00d78551a20f486e9e

SHA512
3df3ca531546a6c6291985c1782682d6623923f6b78552ea8fb953ca47f34d935ccd461d2d1306881020efeb8951938f2d5f1ce216ebd7b643b6ee8f7013ba3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LD4PM1UP74BHNQHBASGG.temp

Filesize
7KB

MD5
209b009dae3adb6055057c02e5a96ea8

SHA1
b301a54a9dc59f2ddafd23c9ab1c396398b2b9d1

SHA256
0358820a39aae00ebbaf5c50ef937771cf339abae61275aba09f433b3738ac71

SHA512
0a278f5a9c52a4fae847a63bf6206d197359740a8817a898e836d6091381a393e2b3a732211e78d5f3ada5fa894c399d1baf08ac50b8bb2b208dc642e4b236b6

Download Submit
memory/2532-5-0x0000000001FC0000-0x0000000001FCE000-memory.dmp

Filesize
56KB

Download
memory/2532-32-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2532-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/2532-4-0x0000000001F60000-0x0000000001F6A000-memory.dmp

Filesize
40KB

Download
memory/2532-6-0x0000000004750000-0x00000000047B0000-memory.dmp

Filesize
384KB

Download
memory/2532-2-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/2532-1-0x0000000000280000-0x000000000030C000-memory.dmp

Filesize
560KB

Download
memory/2532-3-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2660-31-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2660-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2660-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2660-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2660-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2660-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2660-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads