redline | f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe
Size

785KB
MD5

d2f542d38d3cf8abab173c4ce668cd08
SHA1

de5991f684f5054eb191d327b21b301d90601d18
SHA256

f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a
SHA512

f2f92a61fb16630d4de6da59b37b8e1e964916b6831b371900f27ef98c8602a29002bc7edf0f7bd0a75d7e96f941504eed2ae4a34971a8e2c0d1c20ae4cf2f8d
SSDEEP

24576:eQNid6hXNmIvZwJAtDWCzglIejIpqG4yPaw:ZRTm/JA4CKILqg

Score

10^/10

redline sectoprat maloy discovery evasion execution infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

MALOY

194.226.121.151:17731

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2896-34-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2896-31-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2896-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2896-37-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2896-36-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2896-34-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2896-31-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2896-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2896-37-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2896-36-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	SZ8pLRsMimenhWA.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2180	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	SZ8pLRsMimenhWA.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SZ8pLRsMimenhWA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SZ8pLRsMimenhWA.exe

Executes dropped EXE 4 IoCs

pid	Process
2500	autoplay.exe
2676	SZ8pLRsMimenhWA.exe
2140	SZ8pLRsMimenhWA.exe
2896	SZ8pLRsMimenhWA.exe

Loads dropped DLL 4 IoCs

pid	Process
2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe
2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe
2676	SZ8pLRsMimenhWA.exe
2676	SZ8pLRsMimenhWA.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SZ8pLRsMimenhWA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	SZ8pLRsMimenhWA.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2676 set thread context of 2896	2676	SZ8pLRsMimenhWA.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SZ8pLRsMimenhWA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SZ8pLRsMimenhWA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autoplay.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2676	SZ8pLRsMimenhWA.exe
2180	powershell.exe
2676	SZ8pLRsMimenhWA.exe
2676	SZ8pLRsMimenhWA.exe
2676	SZ8pLRsMimenhWA.exe
2676	SZ8pLRsMimenhWA.exe
2676	SZ8pLRsMimenhWA.exe
2676	SZ8pLRsMimenhWA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	SZ8pLRsMimenhWA.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2896	SZ8pLRsMimenhWA.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2500	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	31
PID 2860 wrote to memory of 2676	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	32
PID 2860 wrote to memory of 2676	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	32
PID 2860 wrote to memory of 2676	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	32
PID 2860 wrote to memory of 2676	2860	f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe	32
PID 2676 wrote to memory of 2180	2676	SZ8pLRsMimenhWA.exe	33
PID 2676 wrote to memory of 2180	2676	SZ8pLRsMimenhWA.exe	33
PID 2676 wrote to memory of 2180	2676	SZ8pLRsMimenhWA.exe	33
PID 2676 wrote to memory of 2180	2676	SZ8pLRsMimenhWA.exe	33
PID 2676 wrote to memory of 2140	2676	SZ8pLRsMimenhWA.exe	36
PID 2676 wrote to memory of 2140	2676	SZ8pLRsMimenhWA.exe	36
PID 2676 wrote to memory of 2140	2676	SZ8pLRsMimenhWA.exe	36
PID 2676 wrote to memory of 2140	2676	SZ8pLRsMimenhWA.exe	36
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37
PID 2676 wrote to memory of 2896	2676	SZ8pLRsMimenhWA.exe	37

C:\Users\Admin\AppData\Local\Temp\f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe
"C:\Users\Admin\AppData\Local\Temp\f702a1b2aa5e8f06b47c069afa26909e4a9ea31bfb3328b9efbdb7e396cf250a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\autoplay.exe
  "C:\Users\Admin\AppData\Local\Temp\autoplay.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe
  "C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe
    "C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe"
    3⤵
    - Executes dropped EXE
    PID:2140
- - C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe
    "C:\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SZ8pLRsMimenhWA.exe

Filesize
567KB

MD5
246dc48cada7fba91b7617fe4dfe8433

SHA1
84867d471f524c14296637b191c1f9deefa3eb04

SHA256
8e5ed7d8999d566917e21d2ada4a6c035646387e6d55adf96073fbb18a769eb0

SHA512
a8997b6a18ac82b8b74a9f4229c11ed0ff38cbbfb36815f3dad4e43b9a490f5ec9f6ffeb30bf82afa0fe74132e76cd34a63dd984cb5b077c494c775fa078d901

Download Submit
\Users\Admin\AppData\Local\Temp\autoplay.exe

Filesize
185KB

MD5
76ef16e94f77454aaffdfa4c700be85f

SHA1
9b45b3826706337a11e43248095fb2c62e42d14d

SHA256
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82

SHA512
4185cf9393877fd6d80ecfb7290c10d40a62fc7013d175e5fc91df56870500ea33b518e4f55b4e7d8a7865d3f7707fb5f49f621d5d944bb1edffda4734f99d53

Download Submit
memory/2676-15-0x00000000000D0000-0x0000000000164000-memory.dmp

Filesize
592KB

Download
memory/2676-16-0x0000000000300000-0x0000000000314000-memory.dmp

Filesize
80KB

Download
memory/2676-17-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download
memory/2676-18-0x00000000021E0000-0x000000000223A000-memory.dmp

Filesize
360KB

Download
memory/2676-21-0x0000000004F00000-0x0000000004F1E000-memory.dmp

Filesize
120KB

Download
memory/2860-12-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2896-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2896-34-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2896-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-31-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2896-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2896-27-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2896-37-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2896-36-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download