redline | 8b904606790976539fd73805d8a8283a30b67907bc35f7e98e3f679d500d0aca

General

Target

Redeye Email Checker.exe
Size

1.8MB
MD5

ee91506ae8f5516e3db1a0931ea8843c
SHA1

6862064d8a664626fd6d39e4d4c57d6c68ac245d
SHA256

8b904606790976539fd73805d8a8283a30b67907bc35f7e98e3f679d500d0aca
SHA512

d8bd0818dcdcf3904fb93af282c27f25607d980a5de18a4ff4081ecab43eee42408ba381e33531bdc5c261875b4076c214244c34d765cb0cd3f3351542cc1ae9
SSDEEP

24576:SR+kTF4nMlM6O7PxpXkEX7L1Mfyx4AdGIBDA2d7/cqPfRtItNaFIJ0AwJyxWgZqe:++uKnzZVkS10AdGI9lvRt8PxWYskAD

Score

10^/10

redline sectoprat ultimatecrackpack discovery execution infostealer persistence rat trojan

Malware Config

Extracted

Family

redline

Botnet

UltimateCrackPack

C2

51.83.170.23:16128

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2324-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2324-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2324-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2324-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2324-22-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2324-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2324-18-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2324-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2324-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2324-22-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Executes dropped EXE 1 IoCs

Processes:

Ultimate-Crack-Pack.exe

pid process

1584 Ultimate-Crack-Pack.exe

pid	process
1584	Ultimate-Crack-Pack.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\msconfig.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration\\msconfig.exe.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2508 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ultimate-Crack-Pack.exe

description pid process target process

PID 1584 set thread context of 2324 1584 Ultimate-Crack-Pack.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2508	powershell.exe

description	pid	process	target process
PID 1584 set thread context of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Ultimate-Crack-Pack.exepowershell.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ultimate-Crack-Pack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2508 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 2508 powershell.exe
Token: SeDebugPrivilege 2324 RegAsm.exe

pid	process
2508	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2324	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Redeye Email Checker.exeUltimate-Crack-Pack.exe

description	pid	process	target process
PID 1820 wrote to memory of 1584	1820	Redeye Email Checker.exe	Ultimate-Crack-Pack.exe
PID 1820 wrote to memory of 1584	1820	Redeye Email Checker.exe	Ultimate-Crack-Pack.exe
PID 1820 wrote to memory of 1584	1820	Redeye Email Checker.exe	Ultimate-Crack-Pack.exe
PID 1820 wrote to memory of 1584	1820	Redeye Email Checker.exe	Ultimate-Crack-Pack.exe
PID 1820 wrote to memory of 2488	1820	Redeye Email Checker.exe	Redeye Email Checker.exe
PID 1820 wrote to memory of 2488	1820	Redeye Email Checker.exe	Redeye Email Checker.exe
PID 1820 wrote to memory of 2488	1820	Redeye Email Checker.exe	Redeye Email Checker.exe
PID 1584 wrote to memory of 2508	1584	Ultimate-Crack-Pack.exe	powershell.exe
PID 1584 wrote to memory of 2508	1584	Ultimate-Crack-Pack.exe	powershell.exe
PID 1584 wrote to memory of 2508	1584	Ultimate-Crack-Pack.exe	powershell.exe
PID 1584 wrote to memory of 2508	1584	Ultimate-Crack-Pack.exe	powershell.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe
PID 1584 wrote to memory of 2324	1584	Ultimate-Crack-Pack.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe
"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'
3⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Redeye Email Checker.exe"
2⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe

Filesize
115KB

MD5
dc6f230a993249cbe632aea3edbbd63e

SHA1
ee67ed14eb647918d0d7ffd11ba7b665eeb19c27

SHA256
a6c001e47fd68b6c97fa484c5c98f918eed5d231bd8f1a4e4ad65af20788118b

SHA512
7e9b46e5d8e8fa609c839d570cf6cf80c7464de553f094e02b6f86e96dc81ce65a1f5f071acd6fadec9d1f4690f48972d4425a7dc2bb0bab7d0588eae81fa5e2

Download Submit
memory/1584-10-0x00000000002B0000-0x00000000002D2000-memory.dmp

Filesize
136KB

Download
memory/1584-8-0x0000000000960000-0x0000000000984000-memory.dmp

Filesize
144KB

Download
memory/1820-1-0x0000000000FE0000-0x00000000011A8000-memory.dmp

Filesize
1.8MB

Download
memory/1820-0-0x000007FEF5E53000-0x000007FEF5E54000-memory.dmp

Filesize
4KB

Download
memory/2324-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2324-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2324-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2324-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2324-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2324-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2324-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2324-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2488-9-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads