redline | 21e4c68118505da33246b093c06fed75cc049c785db86ef79950fff50c206f59

General

Target

f0c6f971c7f14c03d37f035434567fb5.exe
Size

95KB
MD5

f0c6f971c7f14c03d37f035434567fb5
SHA1

96f7e647d2885f8eb92cb8ad56396bfce9562118
SHA256

21e4c68118505da33246b093c06fed75cc049c785db86ef79950fff50c206f59
SHA512

6fd2d11935752e3b1ee9ae1b948ddcf1d45650fe12d504fa06ae1b45f4209d65153b258b2317fe36a08aa87187ede49bc2b6c12e28a1670b9cf083ba9e4cd0aa
SSDEEP

1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2y3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdUY

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

154.91.34.250:14555

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1996-1-0x0000000000F30000-0x0000000000F4E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1996-1-0x0000000000F30000-0x0000000000F4E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0c6f971c7f14c03d37f035434567fb5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	f0c6f971c7f14c03d37f035434567fb5.exe
1996	f0c6f971c7f14c03d37f035434567fb5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	f0c6f971c7f14c03d37f035434567fb5.exe

C:\Users\Admin\AppData\Local\Temp\f0c6f971c7f14c03d37f035434567fb5.exe
"C:\Users\Admin\AppData\Local\Temp\f0c6f971c7f14c03d37f035434567fb5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB69.tmp

Filesize
12KB

MD5
d28a7a88548842a2d8fa05daf4ba2f05

SHA1
338cfb4bab4fec2c9f13ec10f2a8fe5b78345878

SHA256
39d4ab602739f949487971557feb03baafbdb13adad3531896ac8f0d1a1afebf

SHA512
ac161893d284b641145106979cb534c30b58227fce98396914ffb44d66e4983d01e9b9fc0c6d2e3c8fb8b2b4be6aaef9b6f2529b27e36623cf514ed251251b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBC5.tmp

Filesize
18KB

MD5
4ad818678dbfdcbdba4d78d1c86e7ed3

SHA1
5bb9631d25e15fbde8174db3087db5eb4cfeeb95

SHA256
9b03bf72f7cfc70b928be16ad5cb05344bc72c5c3778b70de2e81646d03c03c7

SHA512
7a39c25fa57d0b817da2267c2168235ae798155ee28d394bcecf6704b25db332ec5327297d7bb76fea7a82ad61a7e643aafbc10d3ea0f684c2e023a61ee1578a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC10.tmp

Filesize
13KB

MD5
beb8b7af5077ba434672ebc4a41cd83c

SHA1
acea36714cbdda4ad83efb22b4f632c4c50b7dc6

SHA256
6786a1a79d267ef8c5a7eb67f832efe7feda8df1d7ffb51378133ef6a1d78817

SHA512
4534a3041f769d8b101d6db3f2dbca40ae99718efb0419556d4fc0430b9502cec7c3054e4a1f44d825d178b3e1c722c5075461806a88ca8a46a49603c1ff752b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC25.tmp

Filesize
15KB

MD5
5c5b4658a0f18672f61cd1b67351cb9c

SHA1
feade411cc31014100caa7104e18d537abdaf8f9

SHA256
8bd696938c79dc14ac23b297948229ea132692ccf627bd2a93851c7515ea8b02

SHA512
41ce65715fc24ce8f88fe03fb2b547e1deb9c205cfa5e1f4efc620b9b7803915bb81b2ff6a405cf17e34b49f5fcea3b39939260fb7a92253fb1394036a394f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB8.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCCE.tmp

Filesize
92KB

MD5
6093b9b9effe107a1958b5e8775d196a

SHA1
f86ede48007734aebe75f41954ea1ef64924b05e

SHA256
a10b04d057393f5974c776ed253909cafcd014752a57da2971ae0dddfa889ab0

SHA512
2d9c20a201655ffcce71bfafa71b79fe08eb8aa02b5666588302608f6a14126a5a1f4213a963eb528514e2ea2b17871c4c5f9b5ef89c1940c40c0718ec367a77

Download Submit
memory/1996-0-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/1996-1-0x0000000000F30000-0x0000000000F4E000-memory.dmp

Filesize
120KB

Download
memory/1996-2-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/1996-3-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/1996-277-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing