redline | a38c2f09dfc1e0b8d2bbc90cd734cda433079488ac3f8520535c51dfcdf4836a

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2025, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.Evo-gen.12305.exe
Size

1.7MB
MD5

5937ca40bd9145c27e123daaa40b1266
SHA1

455fa1eec4efa958f29ec41f0e1bb9328ae0a2ab
SHA256

a38c2f09dfc1e0b8d2bbc90cd734cda433079488ac3f8520535c51dfcdf4836a
SHA512

68bf97fb2b685b5bbcd729b199bfc2f9a0bccdbbd30ea2d3c4cd93cf63437959a0469e73415d59b5bcbc760569eda27e4101dc7895637c6165f05ab0af3ebfde
SSDEEP

24576:0MqYqSIKFeubKl99mF9wN6zOl8lB5RbMB1b0FThwrUYqsH/f7oALa9X+:VqYxFTW9w/RzC8H5WB1bAjYUALQX+

Score

10^/10

redline sectoprat cheat defense_evasion discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

103.214.142.152:26264

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2652-1-0x0000000000C10000-0x000000000108E000-memory.dmp	family_sectoprat
behavioral2/memory/2652-2-0x0000000000C10000-0x000000000108E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecuriteInfo.com.Win32.Evo-gen.12305.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
44	4220	Process not Found

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecuriteInfo.com.Win32.Evo-gen.12305.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecuriteInfo.com.Win32.Evo-gen.12305.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Software\Wine	SecuriteInfo.com.Win32.Evo-gen.12305.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2652	SecuriteInfo.com.Win32.Evo-gen.12305.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.Evo-gen.12305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3132	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2652	SecuriteInfo.com.Win32.Evo-gen.12305.exe
2652	SecuriteInfo.com.Win32.Evo-gen.12305.exe
2652	SecuriteInfo.com.Win32.Evo-gen.12305.exe
2652	SecuriteInfo.com.Win32.Evo-gen.12305.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	SecuriteInfo.com.Win32.Evo-gen.12305.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.12305.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.12305.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTA1RkI4QTQtQTIwQy00RUFFLUE0MEItRTc5M0ZDNEVFRjZFfSIgdXNlcmlkPSJ7MDZEMUJCRjEtNEVBOS00NUMyLUFENzgtNkNCM0Y0OEI4ODlEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjJGQTkzQjktMzM4NC00QjQyLTlFMEEtQUUxOUEzQUM5Q0ExfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjQwNzM0ODQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4175.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp418B.tmp

Filesize
114KB

MD5
5b3aa0f3eadc7e5d96b84ac9b811d883

SHA1
247abf162ff386bad5db8c2c2ce0f35d79626b20

SHA256
4e43bfa386e86d84b6c3225bda139728681b1ec66713c09771df359581716004

SHA512
9b5ec20ac65c346af3e83d95a70be023f249ea8df7abf8a5d79a9c2c679da873c67702fe22a0fe7c094438b24992c55bb69a302abb3e12ab27541f7364cb83f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp41B6.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp41CB.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp41E1.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp420C.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4250.tmp

Filesize
18KB

MD5
1eeeca8a492bdad41a75bdd41db4e537

SHA1
46328b0d681b45524069097f1e1cd4c96aebab29

SHA256
ac2a17542cfad1f3273a0e3943bd9d303ef1a16192ddb4bc881c045960cfef45

SHA512
cdd39a33b05bfb0818734da8e5fcd44434e8dad2f320acd1e6bc6c5ad23d4fbf955f5c7fcfcccb34b67db5d3a5bfee5faf43d83da10ef7af0cb820e0170ae348

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4261.tmp

Filesize
19KB

MD5
136347d89dfd2db8cda4b5e02dea570e

SHA1
b0da08d79057f4122e2742022611c31b124143f8

SHA256
616b00f8f3152d72c59c24f3945835d1611350ccb79b55006c41d4c28da39f88

SHA512
40d881cc44c9911f39215795dc7f14d82cac3c26c7abbac2bcbfa8d883c1e8f60a79d5d01ebf11f8ccc95ce781783621be4b9e5c102614530d1d87a91fc6f710

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4292.tmp

Filesize
18KB

MD5
0389a54e816494d7914cace0cd8fe6e3

SHA1
8cd51e7bc61cecb57d9e44e634b5418e4ba4e8a5

SHA256
7d6975b5a6c96d2ac6f845e98de6fc6f6539148f04325c159fb1b461183042d1

SHA512
470e446dda3a3ddd0e082bf35df8b13c1a30157fe09132832671c3651e287745caba82f484d0ce5c1670c6ce5adb8a4772744a86bc61921f4fa80e41cab88cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4293.tmp

Filesize
19KB

MD5
417cbfeec4dbf7ca17bf03f5175b569a

SHA1
d63b3d6ad368a10d34184c1edecec76936e0a12a

SHA256
9f0cf0737e225c242d7d4b0b68168120ddff59de3141a91520e57614720ac9ef

SHA512
c7e2213567cc44decf7a4ed9a3a773dc528a402d992316e327e9f4981f3a47064b89a2b6aed94836e3e6f4deeb9707c828344655e37f47c9c0bc99ab88d3b290

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4294.tmp

Filesize
16KB

MD5
c797bdbcd8e59629568c4fdaaf46da7d

SHA1
0be5b4dda1f9842832b1e793f4cfa290c403c7ee

SHA256
bf85017b4b2e5054c1513b1e10c542fdecd8073f6de5859b3046d6179ffdfbd1

SHA512
6bf0ce9ff02441ed5307868f81dfab35849e2351408dfb6e949c094873d136894f5198e552ea8028588ac829c2485a946def03facfd29e14c5675036936179eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42BB.tmp

Filesize
540KB

MD5
0ccdaa679fc908183f28e1faf1392f4d

SHA1
b3eb160b455ccf78886d0b037933bd8e63b23078

SHA256
bc895dae821921bccb378201c382c9cab2b4b6624a9d5c41250228c7995f27b7

SHA512
1e70835eec860cbc14779b9b36e824499c931a731bf6a36ebf85e840cb22ae1052a6e8764e4956cb3d908443799a45340a3623628fa02b524ba8c332cdebde1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42D0.tmp

Filesize
11KB

MD5
3e7324dd7f664daacf992d3284157088

SHA1
0445220b2474508083e34e3ef35b73d8d28dbaec

SHA256
a89e7a6e1ba5d72e09aedc5a69f47d509452c59e62a0ed58680a74211bd9bc94

SHA512
e8be1f705184e986ca68d6c6ecbcc9429d830c148855dadec4934b50fa1081389e0b5914a818d9a2370748380fb8fbea1a652a55fb82dbdc77190141b5654584

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42E8.tmp

Filesize
10KB

MD5
73aa68deb9b4bb3f6d6478fdf80daebd

SHA1
25c2eb9fb5e54b9f17a6d9d537970d5539a6005b

SHA256
8aa92be1c4abbc83da714182c441ca4013ed554208730c76409bae0104da2dac

SHA512
707bb25f12497b4326ba41de5609d7ebf7f823c307977b603fecab38276f08a9702a5ad5590c8efa042458d937c21754acc4505ef0ed7dd83900f5c959cf4ac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4300.tmp

Filesize
12KB

MD5
b5facfba7ab478b5ac784b02ca1eba3e

SHA1
85ae57b8233b33914a10f9ba6ebee52fca164b9a

SHA256
4347e11be0e3778403b8e0a9d1340c035a4eda8e51f5c390529e7ff378223ce0

SHA512
f79d530743c61aef9c03ff0b5ab24cad6301e2d212dd7b00be21079e7e546cf9d1a9a4d15773c033c46e88ea1439cbff4e3ae5a76a93b346a45492feb0609ad2

Download Submit
memory/2652-7-0x0000000007CF0000-0x0000000007DFA000-memory.dmp

Filesize
1.0MB

Download
memory/2652-19-0x0000000008F50000-0x0000000009112000-memory.dmp

Filesize
1.8MB

Download
memory/2652-24-0x000000000A130000-0x000000000A6D4000-memory.dmp

Filesize
5.6MB

Download
memory/2652-23-0x0000000009540000-0x00000000095B6000-memory.dmp

Filesize
472KB

Download
memory/2652-22-0x00000000094A0000-0x0000000009532000-memory.dmp

Filesize
584KB

Download
memory/2652-21-0x0000000009190000-0x00000000091F6000-memory.dmp

Filesize
408KB

Download
memory/2652-20-0x0000000009650000-0x0000000009B7C000-memory.dmp

Filesize
5.2MB

Download
memory/2652-25-0x0000000009DC0000-0x0000000009DDE000-memory.dmp

Filesize
120KB

Download
memory/2652-9-0x0000000000C10000-0x000000000108E000-memory.dmp

Filesize
4.5MB

Download
memory/2652-0-0x0000000000C10000-0x000000000108E000-memory.dmp

Filesize
4.5MB

Download
memory/2652-6-0x0000000007AC0000-0x0000000007B0C000-memory.dmp

Filesize
304KB

Download
memory/2652-5-0x0000000007A50000-0x0000000007A8C000-memory.dmp

Filesize
240KB

Download
memory/2652-4-0x00000000079F0000-0x0000000007A02000-memory.dmp

Filesize
72KB

Download
memory/2652-3-0x00000000080E0000-0x00000000086F8000-memory.dmp

Filesize
6.1MB

Download
memory/2652-2-0x0000000000C10000-0x000000000108E000-memory.dmp

Filesize
4.5MB

Download
memory/2652-1-0x0000000000C10000-0x000000000108E000-memory.dmp

Filesize
4.5MB

Download