redline | 8bb2330716103069cb5071a4b6ecc28ee02113a5becca122ac1938df89801361

General

Target

SetupPro_R1.exe
Size

1.1MB
MD5

ab619a2ccbab2c5f3df2f6e53a47b224
SHA1

45e1aa1cacf636cf75ca9ec5d06cc77e87019c40
SHA256

fc6ded4effe32e8e5a392ddc9e73b54c11bed343d7981daa3393c3bffe058abc
SHA512

fab90bdc1cf52288c81384b1eec7d544b3d472ce6fa0c899076f93ef00e8f06b03d296cb380f3839d02d5f01a9a4ba5440dafc4632dfbac32c8ae21e1c13c5a8
SSDEEP

24576:siaaWD24cuYYbT9tfc1NaQH1NR9d07FE5z5ONAWBPttJVi0jh78H4D:slaWFB7nT2N3rREFEgftJVj/

Score

10^/10

redline sectoprat 11 discovery infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

11

C2

vigasiergu.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5020-26-0x00000000009B0000-0x00000000009D2000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5020-26-0x00000000009B0000-0x00000000009D2000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Deletes itself 1 IoCs

Processes:

Giudichera.exe.com

pid process

3800 Giudichera.exe.com
Executes dropped EXE 3 IoCs

Processes:

Giudichera.exe.comGiudichera.exe.comRegAsm.exe

pid process

2056 Giudichera.exe.com
3800 Giudichera.exe.com
5020 RegAsm.exe
Loads dropped DLL 1 IoCs

Processes:

SetupPro_R1.exe

pid process

4528 SetupPro_R1.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Giudichera.exe.com

description pid process target process

PID 3800 set thread context of 5020 3800 Giudichera.exe.com RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2056	Giudichera.exe.com
3800	Giudichera.exe.com
5020	RegAsm.exe

pid	process
4528	SetupPro_R1.exe

description	pid	process	target process
PID 3800 set thread context of 5020	3800	Giudichera.exe.com	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

SetupPro_R1.execmd.execmd.exefindstr.exeGiudichera.exe.comPING.EXEGiudichera.exe.comRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupPro_R1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giudichera.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giudichera.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3936 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3936 PING.EXE

pid	process
3936	PING.EXE

pid	process
3936	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Giudichera.exe.comRegAsm.exe

pid	process
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
3800	Giudichera.exe.com
5020	RegAsm.exe
5020	RegAsm.exe
5020	RegAsm.exe
5020	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

SetupPro_R1.execmd.execmd.exeGiudichera.exe.comGiudichera.exe.com

description	pid	process	target process
PID 4528 wrote to memory of 3552	4528	SetupPro_R1.exe	cmd.exe
PID 4528 wrote to memory of 3552	4528	SetupPro_R1.exe	cmd.exe
PID 4528 wrote to memory of 3552	4528	SetupPro_R1.exe	cmd.exe
PID 3552 wrote to memory of 4224	3552	cmd.exe	cmd.exe
PID 3552 wrote to memory of 4224	3552	cmd.exe	cmd.exe
PID 3552 wrote to memory of 4224	3552	cmd.exe	cmd.exe
PID 4224 wrote to memory of 3376	4224	cmd.exe	findstr.exe
PID 4224 wrote to memory of 3376	4224	cmd.exe	findstr.exe
PID 4224 wrote to memory of 3376	4224	cmd.exe	findstr.exe
PID 4224 wrote to memory of 2056	4224	cmd.exe	Giudichera.exe.com
PID 4224 wrote to memory of 2056	4224	cmd.exe	Giudichera.exe.com
PID 4224 wrote to memory of 2056	4224	cmd.exe	Giudichera.exe.com
PID 4224 wrote to memory of 3936	4224	cmd.exe	PING.EXE
PID 4224 wrote to memory of 3936	4224	cmd.exe	PING.EXE
PID 4224 wrote to memory of 3936	4224	cmd.exe	PING.EXE
PID 2056 wrote to memory of 3800	2056	Giudichera.exe.com	Giudichera.exe.com
PID 2056 wrote to memory of 3800	2056	Giudichera.exe.com	Giudichera.exe.com
PID 2056 wrote to memory of 3800	2056	Giudichera.exe.com	Giudichera.exe.com
PID 3800 wrote to memory of 5020	3800	Giudichera.exe.com	RegAsm.exe
PID 3800 wrote to memory of 5020	3800	Giudichera.exe.com	RegAsm.exe
PID 3800 wrote to memory of 5020	3800	Giudichera.exe.com	RegAsm.exe
PID 3800 wrote to memory of 5020	3800	Giudichera.exe.com	RegAsm.exe
PID 3800 wrote to memory of 5020	3800	Giudichera.exe.com	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\SetupPro_R1.exe
"C:\Users\Admin\AppData\Local\Temp\SetupPro_R1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c cmd < Avvelenate.wma
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^xrqXljTjFhhIpucDBfVEqglRCfJobNSJnrzZDScrcRxBpUDsUEHGEiXyTocUCLPScElyMvqJTSopUIHILshTyktsyguxbBAKeCuFJbEbEYNMYOklBMplbVMpmTZndGkasnisCeYhNQginaaseVT$" Lume.wma
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
  - - C:\Users\Admin\AppData\Roaming\Giudichera.exe.com
      Giudichera.exe.com I
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Users\Admin\AppData\Roaming\Giudichera.exe.com
        
        C:\Users\Admin\AppData\Roaming\Giudichera.exe.com I
        5⤵
        Deletes itself
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3800
      - C:\Users\Admin\AppData\Roaming\RegAsm.exe
        
        C:\Users\Admin\AppData\Roaming\RegAsm.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5020
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu781F.tmp\nsExec.dll

Filesize
6KB

MD5
09c2e27c626d6f33018b8a34d3d98cb6

SHA1
8d6bf50218c8f201f06ecf98ca73b74752a2e453

SHA256
114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1

SHA512
883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954

Download Submit
C:\Users\Admin\AppData\Roaming\Avvelenate.wma

Filesize
572B

MD5
91489f7cb5199fe13219aa9b7a7e723c

SHA1
482ffe2c6b6f36c3d66fc7dbf68e132f9af97540

SHA256
b642e6edbb72668712e16d1ff91c84345ac66c06cea4a3c7b1eee0efc429966c

SHA512
ec82cc5c259d8a6a6c27bf25891c38e3f0931801fcb68d9755a5c0a8200ca05d8c2b7edee11df92550763f207984486993eccf4365b70eeabe4283a4909417f7

Download Submit
C:\Users\Admin\AppData\Roaming\Dolcemente.wma

Filesize
1.2MB

MD5
dc0c8bcd6acf846ed6e6d2883d7ffde2

SHA1
b522eb73890c76df3c3950523193e0b8c7be8486

SHA256
33cc49151629e72790bab5e8c9949fd81d34d1d9933521f36facae6eb6ad44a9

SHA512
80e563fde5e206029af0fc0c5701c99310bcc68e092cecb3b7a6db8b229cee7adac2e31223aa0e0baa47077aa7f39ba216accf843db908f53744a2bb9fda03b5

Download Submit
C:\Users\Admin\AppData\Roaming\Giudichera.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Roaming\Lume.wma

Filesize
872KB

MD5
47f4ed3206fed19d16fa86590e570dfc

SHA1
fba632fd00bd68c048b5c7114da181d55023d779

SHA256
d54a87064504a8ba9555abd8623ac1c86dea26715e4f767e12f5231d23d791b9

SHA512
2107e6f7a47687f3c137d9e869f76275df2bbe4cf33b205c818272f5243f1be383d97d952cff9a17fef778fac23da73026ed627ab01dc1e0dd13a4149b53bca3

Download Submit
C:\Users\Admin\AppData\Roaming\Mantenere.wma

Filesize
116KB

MD5
ff88598a19bb1fc42bec363bb6860395

SHA1
c25dbcbf9ba61950a6014022430c976b4105dd02

SHA256
e6c8db998308ecd2379e4e102c88cdc1eeb4cc0dc499e77ae281ee24d93c39f7

SHA512
530d2262ec0f8800760f826321f5b60c6e56244ca9f0b4e3eee709b9a410c09b85c177b71161ecc80f356b045a2a1bc4cd964a485e9cf50f9761ccbf0aac2a47

Download Submit
C:\Users\Admin\AppData\Roaming\RegAsm.exe

Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
memory/5020-26-0x00000000009B0000-0x00000000009D2000-memory.dmp

Filesize
136KB

Download
memory/5020-30-0x00000000058C0000-0x0000000005ED8000-memory.dmp

Filesize
6.1MB

Download
memory/5020-31-0x00000000052C0000-0x00000000052D2000-memory.dmp

Filesize
72KB

Download
memory/5020-32-0x0000000005430000-0x000000000553A000-memory.dmp

Filesize
1.0MB

Download
memory/5020-33-0x0000000005360000-0x000000000539C000-memory.dmp

Filesize
240KB

Download
memory/5020-34-0x00000000053A0000-0x00000000053EC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads