redline | 0d7db567df0c03f033db70107c7699d21fdc046d3b502160e45b6c26a7a5291d

Analysis

max time kernel
140s
max time network
158s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/02/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/random_4.exe
Size

1.7MB
MD5

f662cb18e04cc62863751b672570bd7d
SHA1

1630d460c4ca5061d1d10ecdfd9a3c7d85b30896
SHA256

1e9ff1fc659f304a408cff60895ef815d0a9d669a3d462e0046f55c8c6feafc2
SHA512

ce51435c8fb272e40c323f03e8bb6dfa92d89c97bf1e26dc960b7cab6642c2e4bc4804660d0adac61e3b77c46bca056f6d53bedabcbeb3be5b6151bf61cee8f4
SSDEEP

24576:+ShI0oE/JeMqdgRvsVsV3/AvUeCgzXw2UT+9E8tftrvOHcLQgrICC1UVAmWy/IW:+STZJPqyhWzXRU6l3rIDUmGhgscIa

Score

10^/10

redline sectoprat cheat defense_evasion discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

103.84.89.222:33791

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral23/memory/432-1-0x0000000001350000-0x00000000017C8000-memory.dmp	family_sectoprat
behavioral23/memory/432-2-0x0000000001350000-0x00000000017C8000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random_4.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random_4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random_4.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	random_4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
432	random_4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random_4.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
432	random_4.exe
432	random_4.exe
432	random_4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	random_4.exe

C:\Users\Admin\AppData\Local\Temp\quarantine\random_4.exe
"C:\Users\Admin\AppData\Local\Temp\quarantine\random_4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6AF5.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6B1A.tmp

Filesize
92KB

MD5
6d9ead954a1d55a4b7b9a23d96bb545e

SHA1
b55a31428681654b9bc4f428fc4c07fa7244760f

SHA256
eab705a4e697fa8c54cdbe7df8d46c679df9878c327a003819bb2bf72d90919c

SHA512
b9422f770aa156c13f63399aae96d750f273a6db7c9177b725660aa236a04ca7c4e3bf64d394de3a1f1ec2ad49b60528023aee37b7c195ed70073c049980a322

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C4E.tmp

Filesize
9KB

MD5
17b93f1bc40fa6ea446d0bd23c033a08

SHA1
2a356ab51c6e6a4b9f5609fb4fde2bacf98c7c85

SHA256
dd41e8bf3bd297a78fd0787ff67e0571499ecb126cf7ca089326770be6772a4c

SHA512
637f0e78731d3a948777101c55fe6f1651a417f6bf9424c75483ee29bd0514424aa912be2fc01c9f10e685efd8d62020f5a91268c3b37fe574ef1b3b56fb7696

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C61.tmp

Filesize
15KB

MD5
12dba87e328bdea78bea400024c6d3f2

SHA1
333d837918b48e6d2bb322fa8872857eb29d8cfb

SHA256
b189b756d97cb0ad1c70e0c3078b4e52430ec942926d2e633d03c5397690abca

SHA512
ae429e11f968dc79df2a948cf1eaa3bf4181297aede906f63c48f52934b4d997defe9e40514cf0affa42be34ca459442d30abb85f91818b5115645308380a745

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C62.tmp

Filesize
865KB

MD5
dafd5593ccc3067e4fcf5c4448bdcca5

SHA1
6819f1706cecc8eeca3eb7e26d9cad570c802c42

SHA256
10a97c0a47e9b633334a5fef74ff9d72317f5d94c43e976dbe6babf29ea941c7

SHA512
0f9692e10c7b169705bd6390bfc88b9f68fda9afb6457adaa2395932ba7f9fe54e7eef65bce4af9c1724f10e42d0a8144d2a046070be55b08fabc238f1bb80af

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C64.tmp

Filesize
17KB

MD5
c4bb7669c2585989251676691999cd5a

SHA1
2308b1d3c37bfd403485010f96211a305c055198

SHA256
cd942121f507d54a4f1302724fd051acb04cffefdf00f180a7e89c2407c43535

SHA512
5db971313f5d63cca9b97576226bc9cc78e847fd2e8249cc4612ddc99685af426a5c4b8ded25bc262d9cab4eebf97db1767adf9c2ebf4f1531b4d0e12a7caa98

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C74.tmp

Filesize
303KB

MD5
a4a5692a0c14087965e786f878d59550

SHA1
e2c8e20eb0e30c20cb7a5405e4e4233e49a6c6ca

SHA256
01676c0b74acf9e3163b11e8e333d0dd48cb9bb48fe335973745cedc9d344195

SHA512
7002589f18435a8bbd30f37b52ab16a52b7ad4043627ab2de0456d610fe837a622de155966735314a3e668352691f5fed8ecb39f5c08dc383ac0112b39bf22d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C75.tmp

Filesize
13KB

MD5
4b5bd9af62c6a4ebac73205d1f4db8ad

SHA1
d6360cffc4ac18952ec6f6e1045a4a7632b4cebf

SHA256
e896953698dcef2d7e0c8009e88c0133c12e5fddd0433da2c8d22ff1c5f35e25

SHA512
4e87af08e617164b8557dcbf2104d15d7821192c81c463e056c00b21330a434e679fb3936c86fa0592c2246151261aa197cd8befe0e70d9857934e9acd8ff627

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6D00.tmp

Filesize
663KB

MD5
0429a1bc8767de731ed8fe48218f0fa4

SHA1
bb472b9307353d3c9dbcfc3d43b25df60173e76e

SHA256
4b22e80d6bedddcdf90f94816ae464556a789605002009362951025aeda8b50f

SHA512
46a7b170482a46a9913fd308a046200795ddfd09d6cf9ba9d97041bf3099512450342d6f140a7c067137c188a38654571b66bae1f1b5ea69aef0db3d17e833eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6D7C.tmp

Filesize
325KB

MD5
0b2671defa4665efe129789f9ee3a2ad

SHA1
ef8fbc5a1b76ceb8e0d31751b911a740e80f407e

SHA256
1854f443e07c1c9eaa27d0c56c84667a2d44ac8dd7ad6b2ee79a8d1b9ba1d723

SHA512
dc3c39f498c96878471a2fcacf8edb7de6d63d8578f7f7366d60556b8a436b6773608a4716c1ce513fbaa761051d35c056c3be3090bdd0d761b4659efcaa2c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6DF0.tmp

Filesize
17KB

MD5
4d51aebe24f9f9a485af22bb5c7e106d

SHA1
9e678604054461c971ed05fff383629dac39dbf5

SHA256
a9fcd20db23d21644ef35f9521dd560525cda9167da917f171b9d3fb752f2e29

SHA512
21fd0d2d14f913db0350fae7269e95433c373e0bce727534209588f0af143e0aa04896df68c7684ead0a6aaf706355e76056aec4262389bb9b3a13d45f59f892

Download Submit
memory/432-4-0x0000000001350000-0x00000000017C8000-memory.dmp

Filesize
4.5MB

Download
memory/432-0-0x0000000001350000-0x00000000017C8000-memory.dmp

Filesize
4.5MB

Download
memory/432-2-0x0000000001350000-0x00000000017C8000-memory.dmp

Filesize
4.5MB

Download
memory/432-1-0x0000000001350000-0x00000000017C8000-memory.dmp

Filesize
4.5MB

Download