redline | 4e2af86db2326d23ede094f504645213dd0f26f0e86b5059b6cf9bd5a8115dea

General

Target

094c83270e926b418dd431978ae802d8.exe
Size

95KB
MD5

094c83270e926b418dd431978ae802d8
SHA1

0ddbf017e6313f004f0c7b66ee7e2706564f16e1
SHA256

4e2af86db2326d23ede094f504645213dd0f26f0e86b5059b6cf9bd5a8115dea
SHA512

9d7dd275de9b57fd27ae5d8ebcc9a7d4842ed0c0bc8e16e9d1a16b0f7429fec562d771feca9c36c9b27c54127215c00cea772eb3248e7059351f6baa1c0a61c7
SSDEEP

1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed203tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdmY

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

91.92.136.87:26264

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2572-1-0x0000000000210000-0x000000000022E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2572-1-0x0000000000210000-0x000000000022E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	094c83270e926b418dd431978ae802d8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2572	094c83270e926b418dd431978ae802d8.exe
2572	094c83270e926b418dd431978ae802d8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	094c83270e926b418dd431978ae802d8.exe

C:\Users\Admin\AppData\Local\Temp\094c83270e926b418dd431978ae802d8.exe
"C:\Users\Admin\AppData\Local\Temp\094c83270e926b418dd431978ae802d8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBDFB.tmp

Filesize
455KB

MD5
2468258e23657d65926d47db084c13da

SHA1
de474ef0c2ee542b9d3a8634a9575a2366d028ff

SHA256
f57ad3235178b88f91c96c8cacca6e0ea7f906c70617383179fd041e13ff5927

SHA512
c24c8a02e8552178e4fc881716716eb5750f13f92cacbaffd8f75310986d7c257133c828e44fe5173400852e2112e7759a4f88c36ae35f30d47ad43b7b1e9adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBDFD.tmp

Filesize
20KB

MD5
fcd10d5b73ffe3f17ebce5034fc68d98

SHA1
8b26a131055cff0a5ab562e1ba542e9184c366eb

SHA256
dc4fa4b4cfb7813d1dc345685e35aa089ed54a01a022ba4c1c50170a49f95d77

SHA512
d47c9bef1199cce8747029eeaaa04055b53dbc4047e01d4045674839b78254efcd44c5c0833a31d1b02e155f98d646bfb6939a305f9d2d7ce5ce63b9a1678999

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBDFE.tmp

Filesize
298KB

MD5
4a77b008e82af9fa5ffe133981fb91a3

SHA1
3643be034caa09676e37775cd7f9d57f99586edf

SHA256
67ccc1ac8857efd4db368b26e293af696409730c8c09078e4d4b8390e1691f1b

SHA512
5bbd16aaf3674a04c5ac3441c8b6a4605fc7e5852f81629f2848e071f4cc4cf6479691448249deb5ab9f71a38f74ef4667d99be24cc99e3d8ab70bd4090aa20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBE04.tmp

Filesize
11KB

MD5
df4da4cd8127cd8d3dda9694460bb513

SHA1
d459d88d4a7eff1b669996f539e0c1df34498076

SHA256
2967801e30781f5ce3aed79761c33fa6c8dee5c00de490a7a1efaaaf787fc235

SHA512
8e3d98bc3aeb680b3086bd86d629ce80d925867e5e3ab18907c33ed0a0f23e401be0516135ff70deb036b269c613e3f38a1c3d4531f6a6dc5385a554c36ea994

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBE0A.tmp

Filesize
325KB

MD5
0046a9723f1b7ea44e28c494ac77fda7

SHA1
e66a83d345f3b3527a8f9c1b650ac526559e45e2

SHA256
203bcabe5074844c60ba30e0f174563fcd0563a78f911cf06619c6b44bc56320

SHA512
49ca9fcce5c3c2ceef79fc8ca4e5d41f29b92689afc48103c815d780099d8616eb193cf296f597e89ee5b6a6630c3bb8732f306c89854cedff8e649e577e2f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBE20.tmp

Filesize
399KB

MD5
1971b5ee94b5871d552fb057303ce212

SHA1
7117a7084636e4dbba3f92b559dfc0067749c46b

SHA256
058dbd2da2df237e12f6e31b05e031776e983acfdcc77a8bc29cf60f045f3be8

SHA512
cbe78b9c1201f399620d6b9012100a098964e40b930aea60064dcf3ce247b99a150ef2898beaa2f797307554b5a2b0ad5eec8ee522dc95aad086feb929669717

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC2D5.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC2DB.tmp

Filesize
92KB

MD5
102841a614a648b375e94e751611b38f

SHA1
1368e0d6d73fa3cee946bdbf474f577afffe2a43

SHA256
c82ee2a0dc2518cb1771e07ce4b91f5ef763dd3dd006819aece867e82a139264

SHA512
ca18a888dca452c6b08ad9f14b4936eb9223346c45c96629c3ee4dd6742e947b6825662b42e793135e205af77ad35e6765ac6a2b42cefed94781b3463a811f0a

Download Submit
memory/2572-4-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2572-3-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/2572-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2572-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/2572-1-0x0000000000210000-0x000000000022E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing