redline | 1e9ff1fc659f304a408cff60895ef815d0a9d669a3d462e0046f55c8c6feafc2

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TJUCA_random.exe
Size

1.7MB
MD5

f662cb18e04cc62863751b672570bd7d
SHA1

1630d460c4ca5061d1d10ecdfd9a3c7d85b30896
SHA256

1e9ff1fc659f304a408cff60895ef815d0a9d669a3d462e0046f55c8c6feafc2
SHA512

ce51435c8fb272e40c323f03e8bb6dfa92d89c97bf1e26dc960b7cab6642c2e4bc4804660d0adac61e3b77c46bca056f6d53bedabcbeb3be5b6151bf61cee8f4
SSDEEP

24576:+ShI0oE/JeMqdgRvsVsV3/AvUeCgzXw2UT+9E8tftrvOHcLQgrICC1UVAmWy/IW:+STZJPqyhWzXRU6l3rIDUmGhgscIa

Score

10^/10

redline sectoprat cheat defense_evasion discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

103.84.89.222:33791

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2660-1-0x0000000000C00000-0x0000000001078000-memory.dmp	family_sectoprat
behavioral1/memory/2660-2-0x0000000000C00000-0x0000000001078000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TJUCA_random.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TJUCA_random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TJUCA_random.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	TJUCA_random.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2660	TJUCA_random.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TJUCA_random.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2660	TJUCA_random.exe
2660	TJUCA_random.exe
2660	TJUCA_random.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	TJUCA_random.exe

C:\Users\Admin\AppData\Local\Temp\TJUCA_random.exe
"C:\Users\Admin\AppData\Local\Temp\TJUCA_random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1CE5.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1CFB.tmp

Filesize
92KB

MD5
5a11d4c52a76804780cbb414b2595bdb

SHA1
14c89a2283c41b10ce8f1576404e1541c04a8125

SHA256
e1b3260b2607c6a5fcf91575d1de278deceaf4e5f9f0530a3782c6d9567749d8

SHA512
0bffe811cbba5278d39e20b66a5c4770e3855d1f5cbd45161e8ad304b78da73f555a3c42a198378efab3dfc81f384fdaefc6cbb893a708c7e2649a89fdd11762

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D7F.tmp

Filesize
10KB

MD5
ec5a2dd1d01c42dce93e6af3869c36c7

SHA1
de7380fa7f095a5b371cedeea89a05dc581cf0e4

SHA256
b266ba33c8840900f64eb291617fba0b1f9744bf50afe85ca86cd65cfe0cfa60

SHA512
cb92d2cf7ba7d6dcd55b6a6ce5e7788752838dd641e91d7ed6b340ab449dfeb5d50bac4f1d29db1f4f38b8016653ec70df4fe0c7afbca36f49088d86735eb6a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D81.tmp

Filesize
18KB

MD5
e9ec903db15925c00c87f05cebe48f5d

SHA1
0a25d030eea32020f270b6da10b659a948951a17

SHA256
06eecd37d1dca99063e995f6ca04097cfec65bf0c99fead09a234de27704fff6

SHA512
75cdd74bc233958ee89de28e2e471c67041aab9a7eca1bdaf74cf35a0568d26b3c9048fd4386926a45d6ec3eb7b8b666f3349dcc853aa54c47bfa6e0ef7e2c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D82.tmp

Filesize
16KB

MD5
ee22d32f329bfbb1ea13b065507e8939

SHA1
bc1f0d75b283d3bfcc82efb27d9b3ec495b9e15d

SHA256
c3a989910c6efe41ae62f40a993e64069fc76ff29591e50bd8976e7ac52a5b06

SHA512
83cd6989381a47ea75313e07c20389e7f690451781ce50bf1edf59c3e470331ee1f8658600ff3cc8cbb23271ef1c355943e0d6bc2c76d62a72dc7c1c10c19601

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1D83.tmp

Filesize
22KB

MD5
bab67b5f8971432ddd2229a4cb7c3b21

SHA1
2e94d0f35310690fa0ecf50f36aaf661d5ba29f4

SHA256
3f8aa8874f40e3fbbb1f5c0bb61007c93d22d59cf750d10889342a3e1b1c2f01

SHA512
897b18cd09147b206e9fb25255b895bbc278cd1e02963807edf0f67eca875abd004379e9da76cff7daff6c009fd152ac3e02bc535b51f5c2bef107d65ba419c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1DDE.tmp

Filesize
1.1MB

MD5
620a34f6fb1aeed57ef1454b3775cd3b

SHA1
1db369a0cc000848301e7dd183f49b32ded7cd3f

SHA256
6d39f02b050348e965e33fe5c30da89c635a7965eb16cc5b1fc3c995ffb40d56

SHA512
d850eeeab836145eb1b0dc1f858d718cfd8282dca97d4e3d01393b34546eab3ddbb786e49c8867faf56e5d761a2a5f4172cff3967f0db53bc97c97b7ac2a85d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1DDF.tmp

Filesize
17KB

MD5
b3b7df8c6e94e81657300411bcda24db

SHA1
48cdf56e1e6e39e4fdbe81d443d32aaa095dfc04

SHA256
f8bdc9da83cc252cf860e5d6f2d2c0aba0c325bbfad5f61c5272d10597c2466a

SHA512
7fdca695b09f6ddb61b3adbc7b07eeba21a26a5d40b7af23b9edbd5f8d8001bb80411d1e70aa39ce7800b584f55bcc574060d5fd98b95e456fba4e9f372c242f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1DE0.tmp

Filesize
20KB

MD5
f648373d0fc3b6b1b24758d6ad37a9e1

SHA1
7ee952f398f11e40fad1670ca75fd93dbf597804

SHA256
01ed517195282b3f062f8e221127d75522a6d250636a3b08cbfb177a8fcbda8d

SHA512
12d35ef98732b4041efe98aa9b230bfac1a5d03fadfd396f60d72556b99e98e5394c1f551bdf19d648ecceabb5d9b81bf0a703b7f283c8e63ccdaefa1bc85419

Download Submit
memory/2660-0-0x0000000000C00000-0x0000000001078000-memory.dmp

Filesize
4.5MB

Download
memory/2660-1-0x0000000000C00000-0x0000000001078000-memory.dmp

Filesize
4.5MB

Download
memory/2660-2-0x0000000000C00000-0x0000000001078000-memory.dmp

Filesize
4.5MB

Download