redline | c6993e8df120ebf046ba980a17f7c7c14be985a966fb9eac05cde8f840551d90

Analysis

max time kernel
115s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
818e766a7cecb15513ffaa0f34a46660N.exe
Size 4.0MB
Sample240807-hvrn3athjn
SHA256 c6993e8df120ebf046ba980a17f7c7c14be985a966fb9eac05cde8f840551d90
MD5 818e766a7cecb15513ffaa0f34a46660
SHA1 23e37bd84c239b52f749922418d18aa481ffe3c6
SHA512 1307eea5f63a5a39da54f2bbcf901ea30558525efb7553d34620fd3fe973575fbd624c838928262c330b7af4f50de5a835738c6fa4a56b55eb5f1c9a2ad71b47
SSDEEP 98304:V6USMfILYGy0t+GJd3CK8LAqZinvMomMgBZm:V6USMF08G6KbqZioo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat redline discovery infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

redline

127.0.0.1:29254

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234b1-23.dat	family_redline
behavioral2/memory/3644-32-0x0000000000A60000-0x0000000000A7E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234b1-23.dat	family_sectoprat
behavioral2/memory/3644-32-0x0000000000A60000-0x0000000000A7E000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	818e766a7cecb15513ffaa0f34a46660N.exe

Executes dropped EXE 2 IoCs

pid	Process
4428	SQLi Dorks Generator By The N3RoX.exe
3644	registry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SQLi Dorks Generator By The N3RoX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	registry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	818e766a7cecb15513ffaa0f34a46660N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	registry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4428	SQLi Dorks Generator By The N3RoX.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3612	1728	818e766a7cecb15513ffaa0f34a46660N.exe	83
PID 1728 wrote to memory of 3612	1728	818e766a7cecb15513ffaa0f34a46660N.exe	83
PID 1728 wrote to memory of 688	1728	818e766a7cecb15513ffaa0f34a46660N.exe	84
PID 1728 wrote to memory of 688	1728	818e766a7cecb15513ffaa0f34a46660N.exe	84
PID 1728 wrote to memory of 4428	1728	818e766a7cecb15513ffaa0f34a46660N.exe	85
PID 1728 wrote to memory of 4428	1728	818e766a7cecb15513ffaa0f34a46660N.exe	85
PID 1728 wrote to memory of 4428	1728	818e766a7cecb15513ffaa0f34a46660N.exe	85
PID 1728 wrote to memory of 3644	1728	818e766a7cecb15513ffaa0f34a46660N.exe	87
PID 1728 wrote to memory of 3644	1728	818e766a7cecb15513ffaa0f34a46660N.exe	87
PID 1728 wrote to memory of 3644	1728	818e766a7cecb15513ffaa0f34a46660N.exe	87

C:\Users\Admin\AppData\Local\Temp\818e766a7cecb15513ffaa0f34a46660N.exe
"C:\Users\Admin\AppData\Local\Temp\818e766a7cecb15513ffaa0f34a46660N.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Expansion p.1.ini
  2⤵
  PID:3612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\ProgramData\Parameter p.2.ini
  2⤵
  PID:688
- C:\ProgramData\SQLi Dorks Generator By The N3RoX.exe
  "C:\ProgramData\SQLi Dorks Generator By The N3RoX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4428
- C:\ProgramData\registry.exe
  "C:\ProgramData\registry.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Expansion p.1.ini

Path C:\ProgramData\Expansion p.1.ini
Size 20B
SHA256 a0495e6a6a545cd328d2fdd9b256e7103021cd66bb1063a579920d221a8d36e9
MD5 094696334a419f99d71d63b86fc7f49b
SHA1 a36971b7ce76211ea4af6d815b8dcd5dcc212aa4
SHA512 e65c5bccf48b307f6859b1d50448d52be9a5c8d094bc8039e3af1dda648d931c3168e7e937161b7103de5236da3556b07e01363922191a278814d08b7561c8d4
MD5 SHA1 SHA512

Submit Download

Parameter p.2.ini

Path C:\ProgramData\Parameter p.2.ini
Size 151B
SHA256 aa34f57dc4cc9f8fcae7846e15458963d0aa7c5af9cc52391c30bd53de0b421c
MD5 cb351d20770a179675d0718325d6ec3a
SHA1 5afeff9da2e16f6b0ee34c9622dfd1f725359f6c
SHA512 07f4a487110d34444f5511cd8a9e66aa4f79a68f17f0c2605633aeb81e7a2a34ec0b19c7c32ea3e512a8b91f934c93011a5eb3c9aff177dee18dab569dafbd92
MD5 SHA1 SHA512

Submit Download

SQLi Dorks Generator By The N3RoX.exe

Path C:\ProgramData\SQLi Dorks Generator By The N3RoX.exe
Size 3.8MB
SHA256 7335d92aa0d7a2c2233b172e11474aa953c47cb7b8e6bded3dbf91a9d881e973
MD5 15578026730e6167e7de93f7b87b2af2
SHA1 6c554e922ec846d6338d9e97182c30486b154002
SHA512 86452d1b77997455d4eec36cb70328792252cdd1b906ab2e4b8c17a016841dfc2760b305d3b2a1087e498e00ad8e7658cc7557a85183bb9b75d9f7df8e950dab
SSDEEP 49152:vDKt5jqtb72StuLh5cyqHo+oDc+HTst7R39JM9wWAToTCN7x/:L5KLhvN+ooV3ASWQ71
MD5 SHA1 SHA512 SSDEEP

Submit Download

registry.exe

Path C:\ProgramData\registry.exe
Size 95KB
SHA256 10f8b30af4ec6f220771465ac1d4a61700eea7819753c5e0f48e904eee1155a7
MD5 209a42986e38349666b9b74937d5a5b7
SHA1 45c6d2ee869ca292ab770210ceaeeb2c9edb350f
SHA512 1182eafacfb9b8f409215d6c31863bc0724aa2a08602d01fa53549467d2f3626b003c077607219afbe30a645ca345c11589b3558f9d1247b0097548a18791180
SSDEEP 1536:xqswjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed29teulgS6pk:fMUeYr+zi0ZbYe1g0ujyzd5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1728-0-0x00007FFCCED83000-0x00007FFCCED85000-memory.dmp

Download

memory/1728-1-0x0000000000270000-0x0000000000672000-memory.dmp

Download

memory/3644-32-0x0000000000A60000-0x0000000000A7E000-memory.dmp

Download

memory/3644-33-0x0000000005B00000-0x0000000006118000-memory.dmp

Download

memory/3644-35-0x0000000005480000-0x00000000054BC000-memory.dmp

Download

memory/3644-34-0x0000000005420000-0x0000000005432000-memory.dmp

Download

memory/3644-36-0x00000000054E0000-0x000000000552C000-memory.dmp

Download

memory/3644-37-0x0000000005730000-0x000000000583A000-memory.dmp

Download

memory/4428-38-0x0000000000400000-0x00000000007F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads