redline | 6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab

General

Target

6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
Size

495KB
MD5

68d5b0152936d1eeecf03997d00cf576
SHA1

0e5bc3bfc2e60e0578a5d95f801cbcb94dfbc873
SHA256

6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab
SHA512

b7b64b8076af7397cca6cc46e396e38895a0c79ec1f206b3a0debbbb2c2e925b5e6f380bfc06dd393c1fbf0645e5a096207d1170db675936a8d64fbeca877e17
SSDEEP

12288:SIkt/s0yy65Rw0PBtGfycYa8Lmo7PUFHCWDm4+jlfZD:uT65RLcYgskRxMl

Score

10^/10

redline sectoprat hyce discovery execution infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

hyce

C2

193.70.111.186:13484

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2564-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2564-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2564-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2564-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2564-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2564-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2564-28-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2564-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2564-30-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2564-29-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
2792	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2792	powershell.exe
2736	powershell.exe
2564	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
2564	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2564	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2736	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	31
PID 2092 wrote to memory of 2736	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	31
PID 2092 wrote to memory of 2736	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	31
PID 2092 wrote to memory of 2736	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	31
PID 2092 wrote to memory of 2792	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	33
PID 2092 wrote to memory of 2792	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	33
PID 2092 wrote to memory of 2792	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	33
PID 2092 wrote to memory of 2792	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	33
PID 2092 wrote to memory of 2824	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	35
PID 2092 wrote to memory of 2824	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	35
PID 2092 wrote to memory of 2824	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	35
PID 2092 wrote to memory of 2824	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	35
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37
PID 2092 wrote to memory of 2564	2092	6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe	37

C:\Users\Admin\AppData\Local\Temp\6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
"C:\Users\Admin\AppData\Local\Temp\6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LxuTIDG.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LxuTIDG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp43A5.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe
  "C:\Users\Admin\AppData\Local\Temp\6902bb3159915f7e95e3a03c06c00d195200d6fd3b4b987a324c0491fbfbddab.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp43A5.tmp

Filesize
1KB

MD5
d9d1f5e9e197dd04687e20dd43276882

SHA1
143ce23a61ccce95c9404aab2fc8e7086d1a76a5

SHA256
fe078e584e6e667291181ff528e38119c6000646f249b3dd74aac42b238d1045

SHA512
64fc7905a93533abcefc1a599da7000a20806cb9acd2801dc40931a62f72fe72354fcc479d67ad6562104fa50a6f7b351ff6c68c1e9f9b15eecf07863499fe9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6FF4.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7019.tmp

Filesize
92KB

MD5
a58d87b023e155c10b4e15fdfc6fcb06

SHA1
0ee449b782aeac54c0406adde543f19ecd9dfd38

SHA256
331b040f0bd7731b64e72a837ad86943379ff02e239c305d200108fe7e3c8c61

SHA512
1965574101a71a640efb135a49c4a968fd5feb328779c33936047afb2209424b44fba3a1ccdacee959ce5a016f22b49c8b42dc543476b11f83df0feb1b080eae

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ed20ec86375a2190ea06714faf6230a4

SHA1
92ede25d8d7bea93be93381f05c4c43c606c659a

SHA256
c265378724233e6e3de2c78f506ac270df003075f7ca1edb610cc1f5c5e276da

SHA512
c814b20b768d2d6dc835e53134071bdc28ce833e6218715364ce5cfc7563589e90ed1aef4b34819d97c36a7335f179ec5f894914801cc2668d938749a331494b

Download Submit
memory/2092-31-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-1-0x0000000000860000-0x00000000008E2000-memory.dmp

Filesize
520KB

Download
memory/2092-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-3-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2092-4-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-5-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/2092-6-0x0000000004FF0000-0x0000000005052000-memory.dmp

Filesize
392KB

Download
memory/2092-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2564-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-25-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-30-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-29-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2564-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads