redline | 9bdef064f9693bbae4a073b09a795c7b27e7486c10b3c7d920019ca3729bb434

General

Target

PRODUCT LIST.exe
Size

1.7MB
MD5

a9b805862ccee6848ce91ef51a31f71d
SHA1

4ca749b30f879945324811f5924996765aa7d2e4
SHA256

9bdef064f9693bbae4a073b09a795c7b27e7486c10b3c7d920019ca3729bb434
SHA512

94b6cc887127129a3b51dd68b8d29e417a70e7538668f5bfb4d5e1769d74e2ce44dcef9f36ab6021e04fb1e78f710bcc859163e064d91793e5a3b756fe067d97
SSDEEP

24576:DRhMoSwfXo0P9Ej+zE2bb1SfyeeYF2yjfLV/JFzQXYiU4L/E/pWWG8WHHSx44s8/:DgNwfevYoaTerPtsYikWWG8GJ88Y6eb

Score

10^/10

redline sectoprat discovery evasion infostealer rat spyware stealer themida trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2376-7-0x0000000000B70000-0x0000000001124000-memory.dmp	family_sectoprat
behavioral2/memory/2376-183-0x0000000000B70000-0x0000000001124000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	PRODUCT LIST.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRODUCT LIST.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRODUCT LIST.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2376-7-0x0000000000B70000-0x0000000001124000-memory.dmp	themida
behavioral2/memory/2376-183-0x0000000000B70000-0x0000000001124000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PRODUCT LIST.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2376	PRODUCT LIST.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PRODUCT LIST.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2376	PRODUCT LIST.exe
2376	PRODUCT LIST.exe
2376	PRODUCT LIST.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	PRODUCT LIST.exe

C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD4C6.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD4DB.tmp

Filesize
114KB

MD5
a8d76122219e7c8a069dd18e5a355aa4

SHA1
11f5a037ed0f3d8b0f4ff1755a62a94429337942

SHA256
1a9c71db5bdfe22c58fc8ed8a80ed0b24277f676dcb548cc79adb6e45a8d0a6f

SHA512
fd4ee2089dda5fe7fd5f23d67e1d19b8c1f2a270b39a65f8b3612049c72687c07bc3e957a27ab1b3e7f1af849743189ec814a4e0392f40fe89c14a4aa45688f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD526.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD53B.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD541.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD56D.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
memory/2376-16-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-21-0x0000000007370000-0x00000000073D6000-memory.dmp

Filesize
408KB

Download
memory/2376-10-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

Filesize
240KB

Download
memory/2376-11-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download
memory/2376-12-0x0000000005D60000-0x0000000005E6A000-memory.dmp

Filesize
1.0MB

Download
memory/2376-13-0x0000000000B70000-0x0000000001124000-memory.dmp

Filesize
5.7MB

Download
memory/2376-14-0x0000000076796000-0x0000000076797000-memory.dmp

Filesize
4KB

Download
memory/2376-15-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-0-0x0000000000B70000-0x0000000001124000-memory.dmp

Filesize
5.7MB

Download
memory/2376-17-0x0000000007060000-0x0000000007222000-memory.dmp

Filesize
1.8MB

Download
memory/2376-18-0x0000000007760000-0x0000000007C8C000-memory.dmp

Filesize
5.2MB

Download
memory/2376-19-0x0000000008240000-0x00000000087E6000-memory.dmp

Filesize
5.6MB

Download
memory/2376-20-0x00000000072D0000-0x0000000007362000-memory.dmp

Filesize
584KB

Download
memory/2376-9-0x0000000005A50000-0x0000000005A62000-memory.dmp

Filesize
72KB

Download
memory/2376-23-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-24-0x0000000007560000-0x00000000075D6000-memory.dmp

Filesize
472KB

Download
memory/2376-25-0x0000000007620000-0x000000000763E000-memory.dmp

Filesize
120KB

Download
memory/2376-8-0x0000000006130000-0x0000000006748000-memory.dmp

Filesize
6.1MB

Download
memory/2376-7-0x0000000000B70000-0x0000000001124000-memory.dmp

Filesize
5.7MB

Download
memory/2376-3-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-4-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-2-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-1-0x0000000076796000-0x0000000076797000-memory.dmp

Filesize
4KB

Download
memory/2376-182-0x0000000076780000-0x0000000076870000-memory.dmp

Filesize
960KB

Download
memory/2376-183-0x0000000000B70000-0x0000000001124000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads