redline | f52ae5e6bfc76f9ea38be634ce95f6d599ca39c643bc6b8fda09a62213e01cb3

Analysis

max time kernel
108s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2025 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

390FC6C7C2B8F8D411F425A8E4CCAC38.exe
Size

95KB
MD5

390fc6c7c2b8f8d411f425a8e4ccac38
SHA1

a61674f6ef386be9c89d42dc8c7fd50a2f775fb2
SHA256

f52ae5e6bfc76f9ea38be634ce95f6d599ca39c643bc6b8fda09a62213e01cb3
SHA512

0c4fff1b0ebbedc63df667740151f5fee3dc0a5025cf9681f2915fc3667cfaa473cbd5ecbd4515dc9c28b8c2f8915c2e3cc0776031ee7e1ce58b64389854dc04
SSDEEP

1536:FqsIhaqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2otmulgS6pQl:DGaKaYP+zi0ZbYe1g0ujyzdMQ

Score

10^/10

redline sectoprat 20250129 discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

20250129

103.84.89.222:33791

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1716-1-0x0000000000430000-0x000000000044E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1716-1-0x0000000000430000-0x000000000044E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	390FC6C7C2B8F8D411F425A8E4CCAC38.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	390FC6C7C2B8F8D411F425A8E4CCAC38.exe
1716	390FC6C7C2B8F8D411F425A8E4CCAC38.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	390FC6C7C2B8F8D411F425A8E4CCAC38.exe

C:\Users\Admin\AppData\Local\Temp\390FC6C7C2B8F8D411F425A8E4CCAC38.exe
"C:\Users\Admin\AppData\Local\Temp\390FC6C7C2B8F8D411F425A8E4CCAC38.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE3CF.tmp

Filesize
18KB

MD5
14a6774be823bfa4fd168a3b4fe01b76

SHA1
1657ea859340097486c7c959d030583323129495

SHA256
8ba543c4a4659ffd5e29047d9e2c57227f84a6305ce30af9238cb7f252f72fd6

SHA512
c36032cef17b1bef4af6544a781a4fa1b778bcd8df6e8a9238f2792789c653ad1df8b89434797671937bc58d24acbe0af11d2760ea983606230dc526c6970fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE3E6.tmp

Filesize
301KB

MD5
ddb52f627e25b799fe68fa47a7c66a93

SHA1
a1b460ca9e8d9f39b8f426e9255c869270f5e80d

SHA256
f5ba637f1361d7fa4aaddc58d9eb326f1161409243b9c8df944cdb7b5219c76e

SHA512
c36d7723520435f2bf3d296ca22317b533e9ab9ada6068d2786bda70789cf3b647b8174827738e5093df1bb0186e0bcc733c848fefbf0a3947dd6fcf9712ed5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE411.tmp

Filesize
9KB

MD5
4cc744590a3463737e313287fb52f36f

SHA1
47d97c1f5ece64260c02b1aac34c3bdc7dd27368

SHA256
99f554a178fba321d8c5f9e1ee1ba7786fd700c690e2417dc4797d9bf2e9ae94

SHA512
a924a04b07aa27fd3e23ad209327551fa0297d90c8587de0a1be0bb7e077fc5fe036d258a27fb9e56ff525f743e1cc5046231d1149bf55d71af3422058993242

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE412.tmp

Filesize
790KB

MD5
dd07ee5aaef78c8ca6ae03705160c4e9

SHA1
73381b9f237d8a793e66707d8370bd4ceb5f474d

SHA256
efa509e98cf2d7459ac3b29b5811aef2dd7e439dcbd470bcf65a6db4ed384714

SHA512
75eccd96e40437701c0b076713984d302d741e9c9f574b0b216f129117beb52733f78d1fe4528d05237744c72995d54b8941a89fe6e2256c639a9dd9692e5487

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE4D2.tmp

Filesize
14KB

MD5
f02a49d7a2a771f394d9ba7290e38b6f

SHA1
e4e296caeb41b471f6c5b60aef7a8d31bc0f78c9

SHA256
e946d04aea1f1a1852763092c21cfc773d2f129ee908fe29bf345d12bf92a7c0

SHA512
acee180764f08fa429f7fbf030885649a8e86bce2a992494397de566cbbc83822ed8cccdf511d4284b4838da437c64510c2798f6473ca01b5a57f7bec09ef65d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE4D4.tmp

Filesize
16KB

MD5
a17d434183369a8522fbb1c471d28162

SHA1
e4a449778fb3c342edb899008fc1d0d5281e2ffa

SHA256
08a42833009ec04b225e55fc05a782b4870ca82610721976d75246f33ca2572b

SHA512
61e4a80acf4d1e1ceca11fb790957576815b974328e3ae3168ff67ec606a3c4b02fa32cec59b929eca631c90850c1f0666a6b025b1f68d1b2229cc0b3e418326

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE4D5.tmp

Filesize
17KB

MD5
a2b4e7b93bdad09ff37c22e4b7275570

SHA1
8116db54cb000a706ef4f878900816f417e00f98

SHA256
6103b2f556ca7e386b757dd26dd4ea34ce02e068bf1cdd98280a8fe8a15b4ebe

SHA512
3ff290228abdb9f06e6640f0d32ead737bc0161ea2c713d73cf516529e4717a3d4c843e75d641abe3b1b709d9812c6adf2d13229cf7bc80bd1438bd53e3c147f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE4E7.tmp

Filesize
19KB

MD5
29ddc2a8b9bd2f682ec0b3808de4abd6

SHA1
a58815d2ef55d3b5c85a11897b83de47001da075

SHA256
a9058d34a7bcbdd20e3873df4b7d1f251d500a6b09e14195bbb0089d7688e4c4

SHA512
888d85778eb50f4ccb838d15cffca413cf14b5add120d5e5114e18031ba25ba62241e11192a277cef67b4ce40e3041714bbe98c8627d3a6b2be9a62a093025d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE566.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE59B.tmp

Filesize
114KB

MD5
a282f348580510e472a152e35a6b7ae7

SHA1
f4b29bc6e77528f9c5768523dd906ceb5ccde9a1

SHA256
25e9b23c7b67867dabdc6e191b815b6210ca2a7b16af9df1f6d6551c1f381432

SHA512
1da008e19f3224fcb71e53303e79bf654382daadfbf8dae28cdeda8fc589dd7fdc90fb235461321c04c1ab9cb98da739e896b5e2d6cc54ed67e15cc4e1458d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5C7.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5CD.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5E2.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE60D.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
memory/1716-7-0x00000000050F0000-0x00000000051FA000-memory.dmp

Filesize
1.0MB

Download
memory/1716-0-0x00000000752EE000-0x00000000752EF000-memory.dmp

Filesize
4KB

Download
memory/1716-14-0x00000000075E0000-0x0000000007646000-memory.dmp

Filesize
408KB

Download
memory/1716-13-0x0000000006AD0000-0x0000000006AEE000-memory.dmp

Filesize
120KB

Download
memory/1716-12-0x0000000007700000-0x0000000007CA4000-memory.dmp

Filesize
5.6MB

Download
memory/1716-11-0x0000000006790000-0x0000000006806000-memory.dmp

Filesize
472KB

Download
memory/1716-10-0x00000000066F0000-0x0000000006782000-memory.dmp

Filesize
584KB

Download
memory/1716-9-0x0000000006C20000-0x000000000714C000-memory.dmp

Filesize
5.2MB

Download
memory/1716-8-0x0000000006520000-0x00000000066E2000-memory.dmp

Filesize
1.8MB

Download
memory/1716-15-0x00000000752EE000-0x00000000752EF000-memory.dmp

Filesize
4KB

Download
memory/1716-6-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/1716-5-0x0000000004E90000-0x0000000004EDC000-memory.dmp

Filesize
304KB

Download
memory/1716-4-0x0000000004E50000-0x0000000004E8C000-memory.dmp

Filesize
240KB

Download
memory/1716-3-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Filesize
72KB

Download
memory/1716-2-0x0000000005430000-0x0000000005A48000-memory.dmp

Filesize
6.1MB

Download
memory/1716-1-0x0000000000430000-0x000000000044E000-memory.dmp

Filesize
120KB

Download
memory/1716-425-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download