redline | 724902ab0936be774ebeb685d0be152e4fc91da28d4f398944fc98011c204d55

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BSR7D_random.exe
Size

1.7MB
MD5

4ba31c351d47f114de7ec45ba64ec807
SHA1

5314ba39477d0a29c745d8367c1a9bd5d5cae667
SHA256

724902ab0936be774ebeb685d0be152e4fc91da28d4f398944fc98011c204d55
SHA512

5b16d057b084f88cd612002f10a45cf4d3f114ad668c802ea412c4abad04529f4365e4a52a662186f064b1d8bc3bd005e9e073c15fb8a85b3a1ee14cd2026ed8
SSDEEP

24576:UacJzs3Ds96XBY/ELPKnKSqd1wZL+gB4hI7K4mvHP4PTxLc1aoxR9sOhSVas6LoI:UPEtxY1nKSqdusgOXkAawPhAasGo

Score

10^/10

redline sectoprat cheat defense_evasion discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

103.84.89.222:33791

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2168-1-0x0000000000730000-0x0000000000BB6000-memory.dmp	family_sectoprat
behavioral2/memory/2168-2-0x0000000000730000-0x0000000000BB6000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BSR7D_random.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BSR7D_random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BSR7D_random.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2573923862-3221519550-2669654151-1000\Software\Wine	BSR7D_random.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2168	BSR7D_random.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BSR7D_random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2168	BSR7D_random.exe
2168	BSR7D_random.exe
2168	BSR7D_random.exe
2168	BSR7D_random.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	BSR7D_random.exe

C:\Users\Admin\AppData\Local\Temp\BSR7D_random.exe
"C:\Users\Admin\AppData\Local\Temp\BSR7D_random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
1⤵
- System Location Discovery: System Language Discovery
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE57E.tmp

Filesize
15KB

MD5
34d8c602b676c547914b20f9f360ddb8

SHA1
2fa19ea4f58520f8458a2108077aaa6c73ac64f0

SHA256
17c6674c54b55cc0c5c4fdfb451624a6ceeb50aa36dee22c1c2f6b0db89be48d

SHA512
6bd56572b3ecca316da92d3b12f9698bd76757254a9c3758886d3913173e26421a2442256e186a2f145edf4f741be6fedbe2f68662b118490defa8cd02a65123

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE580.tmp

Filesize
287KB

MD5
36c6dca1c52083ae50d8b37890dd7b73

SHA1
3a47dbfec684d2acc4747f3a6df7773c021feda8

SHA256
bf37a56310ec1eb515ff136d14bc63bf251eff1af7d93f9d19c778fa03d8b447

SHA512
9d61fed3cf4ebefafe6b780788e849d22e5e3cf44dc784547d5392bd049dfc4b39ff66c863d18dfc531d43090d4ca525457fa7909905032faa16e545ff226bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE595.tmp

Filesize
12KB

MD5
00e152fc6d19ec1846e623c4dbacb6da

SHA1
1224a09b9268b9d359b76f815add2559a67de124

SHA256
29b4ff47913cd07795a52684588f2395fe3675b0a32a82c1a44c1f9c5d9ec660

SHA512
6de6892dca7ac39b27d99ffe609c5e787bd07a8295f97d4697d82e5793d1da0603130eb06cc22e14f8e03de2239fc26db44a88b149fd4ae59bf1950540994f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5AD.tmp

Filesize
12KB

MD5
1305954e5219d87831bcdc715ab9ea7e

SHA1
13064d2a3d395ac0cc53ec034b42e321cc8b896c

SHA256
e81366368bcc0a6da14026edd4a60a90a3fb001626fe27a2f3d35dd72a5d5d81

SHA512
3c0badfb9c1e8a2c921d91939940f5520de277a868da08aa9b4e14b3d8331a9bba8b6f8dc69704516175ba091944634c771908ec801bc634ea36fc3ad6d119a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5AF.tmp

Filesize
242KB

MD5
59a3d2c13b71c3852f566b7168280722

SHA1
d2481034514c021addc05d86d2db1170c859ad16

SHA256
32cc3eb07c7971e439640a9169f4903b64632b2b74d3bcde093508416fa5aa5a

SHA512
1a5686140992e8d851b0f20c4f7dd0255b5367bb37b20392dabea5fc2c6678c1fc3cf9391a50fdc1f06b5612deecf72679e8f68a95724c95de31ea109e2a591e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5B3.tmp

Filesize
11KB

MD5
4a4df75d7cf04183163b22c2824e4fde

SHA1
eac3a19e65725958812f537f9b0cb4a02b95b775

SHA256
f3a6ff4c5b3ce2cdd9cb9f2ef6a886404b6dcae7c0bafc41982bd1724aac9402

SHA512
daf020df46f31172d7371e76a2b3a48ea110095c76b94c93fe2f0ca57b5b958cb1f56cb792f21e6b0313c3916d28235d26ef06b9204441cc48504b95b7266f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5FD.tmp

Filesize
877KB

MD5
fb66d2db1c3751eb3f8b20924974deb3

SHA1
cf089c3ace8fe4a1f3f7a194f2bf081f07e1ff38

SHA256
90acb3cc651184404970a24a4fb44a1e7c5c6b77c19439a7165c83117ccaca16

SHA512
0b9b2d6e1f2da8346e0ae5c667095e98d0e6632a4eeaad7e4bab1e54ae60c44e9e44800a5cb4f151aa30dd50d4bb3459d29e22f84187ffe9a17f0883d4a9c391

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5FE.tmp

Filesize
16KB

MD5
1e9db9778c42856842767f0fd754de50

SHA1
47f40bbee8ba88e4d93d259c4748a9067ce9b949

SHA256
584afcc880f2c043b00f312ca8f8171e7e0d3aee9fa7aed6cd533c06e209031c

SHA512
05062b6fd006fed3f3d23633c898d9324532b16ea5ce1c6440f9853cd8424322be0a6e4293cc56008a47a744701e7324a5ed63a3a8cb2983e369fd3fee01d8ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE610.tmp

Filesize
960KB

MD5
2a6bee15f2f4e7826df0a69046e9ad36

SHA1
bbbeaee9bcf3d6ace18993ebdc5fa16033e66d73

SHA256
0c90506fc019c117c5b28eb7d85e4265f67e7b75db2a330f3d85ad854c76983e

SHA512
08f85f63caf0dde9549d832ba2d5477a28c438d9883712f8b3332a008b12476baee1e81d8618047aa70e1ef56134973b03e7c059875736bfed9cbd47fa30cefd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE611.tmp

Filesize
18KB

MD5
1f3d04e9d278034b2b140277d7bae1a5

SHA1
de7f14d62c5b69181da17b4adff72586eccf7fb5

SHA256
1eb400981e85cffafc963839e5928d8f071394c4f8a73594c2ccd18cde05d8ee

SHA512
cedd247c7b9a33eeb2aba9d1e7b7029b0553bc362d40117d00c15e72a038def2fbb58ad9cca2518c622aed35e99a6656dd982ddcde9e9478b1617a6a3d4a68a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE623.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE638.tmp

Filesize
114KB

MD5
40b0287b759e98f83ca7b18daa9a090c

SHA1
f55f24127934b6a9e969b23abc14575e402c571a

SHA256
a5dd0a3630b9c06572a4fc75f9b4a3a6fa8187d0e9c34f923a08ead8387e47ea

SHA512
e2116245a8f1cc3d4d75b509b9271be8e2811da3ec6871079d5047e659ca4b99c01236528481c16d4e9a2fb065b1766acb93ecfaca41d675e67799f82e0fdde2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE654.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE669.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE67F.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE69B.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
memory/2168-7-0x0000000007C20000-0x0000000007D2A000-memory.dmp

Filesize
1.0MB

Download
memory/2168-14-0x000000000A0E0000-0x000000000A684000-memory.dmp

Filesize
5.6MB

Download
memory/2168-12-0x00000000090D0000-0x0000000009146000-memory.dmp

Filesize
472KB

Download
memory/2168-11-0x0000000009600000-0x0000000009B2C000-memory.dmp

Filesize
5.2MB

Download
memory/2168-10-0x0000000008F00000-0x00000000090C2000-memory.dmp

Filesize
1.8MB

Download
memory/2168-9-0x0000000000730000-0x0000000000BB6000-memory.dmp

Filesize
4.5MB

Download
memory/2168-15-0x00000000094E0000-0x00000000094FE000-memory.dmp

Filesize
120KB

Download
memory/2168-13-0x00000000091F0000-0x0000000009282000-memory.dmp

Filesize
584KB

Download
memory/2168-0-0x0000000000730000-0x0000000000BB6000-memory.dmp

Filesize
4.5MB

Download
memory/2168-17-0x0000000009B30000-0x0000000009B96000-memory.dmp

Filesize
408KB

Download
memory/2168-6-0x00000000079D0000-0x0000000007A1C000-memory.dmp

Filesize
304KB

Download
memory/2168-5-0x0000000007990000-0x00000000079CC000-memory.dmp

Filesize
240KB

Download
memory/2168-3-0x0000000007F70000-0x0000000008588000-memory.dmp

Filesize
6.1MB

Download
memory/2168-4-0x0000000007920000-0x0000000007932000-memory.dmp

Filesize
72KB

Download
memory/2168-2-0x0000000000730000-0x0000000000BB6000-memory.dmp

Filesize
4.5MB

Download
memory/2168-1-0x0000000000730000-0x0000000000BB6000-memory.dmp

Filesize
4.5MB

Download