redline | 55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce

General

Target

55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe
Size

445KB
MD5

8aff3d560eb4e4550f839bb25a23f33b
SHA1

e531081a7b1697ebf78e9d696d3794cf569d4346
SHA256

55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce
SHA512

76cd25086287b70b53f5f4d674c1fa3b1b49c5e3c94e45134b7b989d1d3cfd8ac96983a0da0e081fd2c39a328e9313b6fac9c10b01b386c16948a336fb084658
SSDEEP

12288:5b5pP4Tbe1LsRU8z0gS5trj6kR3iOjbzTVGg:p5pP4TbYq0gSPxQMVGg

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

154.91.34.250:14555

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2420-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2420-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2420-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2420-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2420-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2420-6-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2420-9-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2420-7-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2420-13-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral1/memory/2420-11-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2420	AddInProcess32.exe
2420	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	AddInProcess32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2420	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	30
PID 1276 wrote to memory of 2460	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	32
PID 1276 wrote to memory of 2460	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	32
PID 1276 wrote to memory of 2460	1276	55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe	32

C:\Users\Admin\AppData\Local\Temp\55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe
"C:\Users\Admin\AppData\Local\Temp\55c9a76d39d5d236202271d56bdf3e8357fc1b15458030a46a628e6ab4443bce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1276 -s 628
  2⤵
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCD5F.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCD75.tmp

Filesize
92KB

MD5
102841a614a648b375e94e751611b38f

SHA1
1368e0d6d73fa3cee946bdbf474f577afffe2a43

SHA256
c82ee2a0dc2518cb1771e07ce4b91f5ef763dd3dd006819aece867e82a139264

SHA512
ca18a888dca452c6b08ad9f14b4936eb9223346c45c96629c3ee4dd6742e947b6825662b42e793135e205af77ad35e6765ac6a2b42cefed94781b3463a811f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCDDD.tmp

Filesize
12KB

MD5
de98f3c62bf530eb7925e2880002b976

SHA1
00f6f6297571b0fb6cc6d3c884b584b8c74493f6

SHA256
737768b601c36723ab07fe3835fb0a0c7d34a11071523e67d721b319b639487e

SHA512
503aff41bf0b7a2c91bca2a5dbf9bde7975b95330f1ef2866ab79be2048f2c77ed48c172913652f9f4900a5e8c9e1f421d48b315541bb51c59dd08157c802c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCDF5.tmp

Filesize
455KB

MD5
2468258e23657d65926d47db084c13da

SHA1
de474ef0c2ee542b9d3a8634a9575a2366d028ff

SHA256
f57ad3235178b88f91c96c8cacca6e0ea7f906c70617383179fd041e13ff5927

SHA512
c24c8a02e8552178e4fc881716716eb5750f13f92cacbaffd8f75310986d7c257133c828e44fe5173400852e2112e7759a4f88c36ae35f30d47ad43b7b1e9adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCDFB.tmp

Filesize
20KB

MD5
fcd10d5b73ffe3f17ebce5034fc68d98

SHA1
8b26a131055cff0a5ab562e1ba542e9184c366eb

SHA256
dc4fa4b4cfb7813d1dc345685e35aa089ed54a01a022ba4c1c50170a49f95d77

SHA512
d47c9bef1199cce8747029eeaaa04055b53dbc4047e01d4045674839b78254efcd44c5c0833a31d1b02e155f98d646bfb6939a305f9d2d7ce5ce63b9a1678999

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCE03.tmp

Filesize
298KB

MD5
4a77b008e82af9fa5ffe133981fb91a3

SHA1
3643be034caa09676e37775cd7f9d57f99586edf

SHA256
67ccc1ac8857efd4db368b26e293af696409730c8c09078e4d4b8390e1691f1b

SHA512
5bbd16aaf3674a04c5ac3441c8b6a4605fc7e5852f81629f2848e071f4cc4cf6479691448249deb5ab9f71a38f74ef4667d99be24cc99e3d8ab70bd4090aa20f

Download Submit
memory/1276-16-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/1276-1-0x0000000000300000-0x0000000000372000-memory.dmp

Filesize
456KB

Download
memory/1276-2-0x0000000001FD0000-0x0000000002040000-memory.dmp

Filesize
448KB

Download
memory/1276-3-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/1276-0-0x000007FEF5DA3000-0x000007FEF5DA4000-memory.dmp

Filesize
4KB

Download
memory/2420-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2420-14-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/2420-15-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2420-17-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/2420-18-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2420-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2420-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2420-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2420-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing