redline | d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce

General

Target

d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe
Size

1.0MB
MD5

742700f0677d095a5d38f64abf5042d7
SHA1

bc3e9168d9f2d4c2dba2fdc00b725ac9199d82c3
SHA256

d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce
SHA512

b45e67c130e2209531efd6fd7d28d9e9f4e79209cc9ebbcecb13e310d6c12c720321062d497b9a3721d93557200ac1a64bea949a78bd2259f9cef24a5329e9c4
SSDEEP

24576:u9btxEObap2SDlQYPFzk6FnYp7HKmfe+ky24B:uNNbA2YQYPFzk6RKHre+kV4B

Score

10^/10

redline sectoprat 3333444555666 discovery infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

3333444555666

C2

80.92.206.82:45827

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2760-23-0x00000000009A0000-0x00000000009BE000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2760-23-0x00000000009A0000-0x00000000009BE000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe

Executes dropped EXE 3 IoCs

Processes:

Ottobre.exe.comOttobre.exe.comRegAsm.exe

pid process

2172 Ottobre.exe.com
1536 Ottobre.exe.com
2760 RegAsm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ottobre.exe.com

description pid process target process

PID 1536 set thread context of 2760 1536 Ottobre.exe.com RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2172	Ottobre.exe.com
1536	Ottobre.exe.com
2760	RegAsm.exe

description	pid	process	target process
PID 1536 set thread context of 2760	1536	Ottobre.exe.com	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Ottobre.exe.comRegAsm.exed9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.execmd.execmd.exefindstr.exeOttobre.exe.comPING.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ottobre.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ottobre.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3252 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3252 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2760 RegAsm.exe

pid	process
3252	PING.EXE

pid	process
3252	PING.EXE

description	pid	process
Token: SeDebugPrivilege	2760	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.execmd.execmd.exeOttobre.exe.comOttobre.exe.com

description	pid	process	target process
PID 228 wrote to memory of 820	228	d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe	cmd.exe
PID 228 wrote to memory of 820	228	d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe	cmd.exe
PID 228 wrote to memory of 820	228	d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe	cmd.exe
PID 820 wrote to memory of 5032	820	cmd.exe	cmd.exe
PID 820 wrote to memory of 5032	820	cmd.exe	cmd.exe
PID 820 wrote to memory of 5032	820	cmd.exe	cmd.exe
PID 5032 wrote to memory of 2436	5032	cmd.exe	findstr.exe
PID 5032 wrote to memory of 2436	5032	cmd.exe	findstr.exe
PID 5032 wrote to memory of 2436	5032	cmd.exe	findstr.exe
PID 5032 wrote to memory of 2172	5032	cmd.exe	Ottobre.exe.com
PID 5032 wrote to memory of 2172	5032	cmd.exe	Ottobre.exe.com
PID 5032 wrote to memory of 2172	5032	cmd.exe	Ottobre.exe.com
PID 5032 wrote to memory of 3252	5032	cmd.exe	PING.EXE
PID 5032 wrote to memory of 3252	5032	cmd.exe	PING.EXE
PID 5032 wrote to memory of 3252	5032	cmd.exe	PING.EXE
PID 2172 wrote to memory of 1536	2172	Ottobre.exe.com	Ottobre.exe.com
PID 2172 wrote to memory of 1536	2172	Ottobre.exe.com	Ottobre.exe.com
PID 2172 wrote to memory of 1536	2172	Ottobre.exe.com	Ottobre.exe.com
PID 1536 wrote to memory of 2760	1536	Ottobre.exe.com	RegAsm.exe
PID 1536 wrote to memory of 2760	1536	Ottobre.exe.com	RegAsm.exe
PID 1536 wrote to memory of 2760	1536	Ottobre.exe.com	RegAsm.exe
PID 1536 wrote to memory of 2760	1536	Ottobre.exe.com	RegAsm.exe
PID 1536 wrote to memory of 2760	1536	Ottobre.exe.com	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe
"C:\Users\Admin\AppData\Local\Temp\d9184ae3da1eafd4621efd0b4c79c0fd01a25b8dfaf876aa57aa100f5f5a1bce.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cmd < Mantenga.mp3
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^QPNBDrUDoFoyGwGysTHVztNiZkZuxkPcfkELVDJSyIjUmeLqWapdhcHMeGBsrOoXPMQcvUlOpOPLSSHWA$" Narcotico.mp3
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ottobre.exe.com
      Ottobre.exe.com a
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ottobre.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ottobre.exe.com a
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mantenga.mp3

Filesize
322B

MD5
b8ed7fb3e3c7514c05c803eba3c4b1b3

SHA1
eba88818b0a4f5eb6163121725d7f74f77e8b10c

SHA256
20efd6eda1c9c4a2724ba6fbb26e6f577c63ad7c09a13789ec94c6c9c0b91e0c

SHA512
d45874180632f42cc8f2291c7a141e19fa1854a4345fd3a9ec6578665a3ead3341babfbdf3aa9d018dddab14e95b6e2e3ddcd274543378798564f7dc0d59f620

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Narcotico.mp3

Filesize
872KB

MD5
aa769a297369ef30a241f3eb1695a2d7

SHA1
79ed28b30dd7c83b77f65cd82cf4c1bacfaabc7d

SHA256
a5aeecf59a359789311c064bcb9f72cca6d2a0cbc5c4cb85757e5a80619bf571

SHA512
b089ebcfc5d787677acaf7a1071f066ab181fc88fc4c909ac9518c771be6d3e2dc5b409833c443d9e5993f8e9e7633978ba3724a29cac2b53c272d5d393403de

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Officio.mp3

Filesize
985KB

MD5
4ba3f3e6275d92afab152791d3cb3afa

SHA1
bdf766055f4022af5cb45b8aaa5cca3e7ac3aa34

SHA256
fed5b872713d9c1a8e7cc6ab7d47b40e9875cc3069ea255718ee7cda8157fefa

SHA512
598e715c32d11dd3e25b5db43bfe984caadddb7913c960f6112ab58bea9d3c544d60210bc21c4604ac9c5e6eb14c67f798de0376c9f2cf5f37ea80ea7e8af48e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ottobre.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe

Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sul.mp3

Filesize
95KB

MD5
c489cbd0c9ccd192846a6eeb8e05966f

SHA1
8fd1c889aeeaab666f56bdb9ddc4466681e35b0c

SHA256
a4acc07cf3d307a00d02b366dbb2c749f6a3efa9bd2f4581f90a6906b004a483

SHA512
d311787e287f8ba8f5ab44e6b2953f6bda216d3e68d354371e92198ffe3a3f054e43b2d1105a353059682fc655685ecf09a228c9790d7445de4a3e12d6732f3f

Download Submit
memory/2760-23-0x00000000009A0000-0x00000000009BE000-memory.dmp

Filesize
120KB

Download
memory/2760-27-0x0000000005850000-0x0000000005E68000-memory.dmp

Filesize
6.1MB

Download
memory/2760-28-0x0000000005180000-0x0000000005192000-memory.dmp

Filesize
72KB

Download
memory/2760-29-0x00000000051E0000-0x000000000521C000-memory.dmp

Filesize
240KB

Download
memory/2760-30-0x0000000005230000-0x000000000527C000-memory.dmp

Filesize
304KB

Download
memory/2760-31-0x0000000005480000-0x000000000558A000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads