redline | 0d7db567df0c03f033db70107c7699d21fdc046d3b502160e45b6c26a7a5291d

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/random_4.exe
Size

1.7MB
MD5

f662cb18e04cc62863751b672570bd7d
SHA1

1630d460c4ca5061d1d10ecdfd9a3c7d85b30896
SHA256

1e9ff1fc659f304a408cff60895ef815d0a9d669a3d462e0046f55c8c6feafc2
SHA512

ce51435c8fb272e40c323f03e8bb6dfa92d89c97bf1e26dc960b7cab6642c2e4bc4804660d0adac61e3b77c46bca056f6d53bedabcbeb3be5b6151bf61cee8f4
SSDEEP

24576:+ShI0oE/JeMqdgRvsVsV3/AvUeCgzXw2UT+9E8tftrvOHcLQgrICC1UVAmWy/IW:+STZJPqyhWzXRU6l3rIDUmGhgscIa

Score

10^/10

redline sectoprat cheat defense_evasion discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

103.84.89.222:33791

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral24/memory/3792-1-0x00000000002D0000-0x0000000000748000-memory.dmp	family_sectoprat
behavioral24/memory/3792-2-0x00000000002D0000-0x0000000000748000-memory.dmp	family_sectoprat
behavioral24/memory/3792-369-0x00000000002D0000-0x0000000000748000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random_4.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random_4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random_4.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine	random_4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3792	random_4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random_4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3792	random_4.exe
3792	random_4.exe
3792	random_4.exe
3792	random_4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	random_4.exe

C:\Users\Admin\AppData\Local\Temp\quarantine\random_4.exe
"C:\Users\Admin\AppData\Local\Temp\quarantine\random_4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp47F.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp494.tmp

Filesize
114KB

MD5
367cb6f6eb3fdecebcfa233a470d7a05

SHA1
9df5e4124982b516e038f1679b87786fd9f62e8b

SHA256
9bcce5a2867bacd7b4cef5c46ba90abb19618e16f1242bdb40d808aada9596cb

SHA512
ed809f3894d47c4012630ca7a353b2cf03b0032046100b83d0b7f628686866e843b32b0dc3e14ccdf9f9bc3893f28b8a4848abff8f15fd4ac27e5130b6b0738d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C0.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C6.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4DB.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4F7.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF1C.tmp

Filesize
15KB

MD5
1617f87d99d4896834e149bf9d3f925d

SHA1
afa942a956a473644e04569c859a2a897647f47a

SHA256
6000136aece8e360b73498904b94b8f2cddc67daddda64e31758ca29b34271d5

SHA512
e00c2ce60ce0497818f3f26620ae8d3a767f7a76303a9b088a442301bdb648e4d2f7837cceb4ed0f6053f2ebc173c73bd431385b8194ae01f6e7686e3f28ee66

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF1D.tmp

Filesize
18KB

MD5
73cf31dee1f6f966982e529adae4e73b

SHA1
40dcdb8bf7900c8cc309881b7e4245e89d1a0a60

SHA256
3c8899c6ac53b47c6a7950ca770632a8b543afc09ffe32046dcda0214eb26386

SHA512
de14ffdfbe62f316611f0434d375d804c9759798e4e33a03de24e24f7c2673b327a43425b42ef9ef7b636277a79a2413474ea993230096ee867fe1725c0f0928

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF31.tmp

Filesize
1.1MB

MD5
98e0ed76368b62fce85df677cebf7554

SHA1
2d28250dffd01145e79370384a993d03e4124ad9

SHA256
2e6d68e85e4ba9af1e5cc0c16d02b39b046cf5e33ad2facb9151b90f0c5be204

SHA512
62da7d3e658d14f94b40ab9196857ebcfed817d961b4d67387968215ba55345c7162e9eba4a6ad5838fca4d084d71cd897c2d2063583d26fc82054a0c2ac6133

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF4A.tmp

Filesize
12KB

MD5
2ee5937ac6fdad00d3056346868c55af

SHA1
18600ca1620d4353bc87344deb2c95558b480f92

SHA256
8349c746eb437129203aed38a9b616f4084a72598eb8f2b62bbd8e89e9598926

SHA512
5502b84da2bfd028cefc544277c21f8a402822fa26a8f1f69efef12c1460bec0fc942958dbc0f0cc3669fa0f61963c10b590db271cc25586c8d47ddc6452497d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFF75.tmp

Filesize
730KB

MD5
6b44f83fb0cae27c8ede4ea1213cfc4f

SHA1
bb1fef0aa1e144849494f8d7ed6767795a98c038

SHA256
363c6eec2ba0ec20fbb27d7a6000769f999b5f49e6e6b2c75d60be0747df3d02

SHA512
9ae30e65af439daa83c51893cb534f8ef3c957b5795e5033ff6656bec5357d725a6a170eb152175eb2c1dc16666dce52156d44d133c468f319e06e8b6dde3490

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFFD7.tmp

Filesize
21KB

MD5
35cee621b23602ac8add31bfa1aeef14

SHA1
dbf96b6c4d1cffadb17cdc68798d98d05d3da323

SHA256
6c3b563c3904c047a42452636c14a295488ca2f92fae6d8130962b4ebf194cb1

SHA512
f94959a4fc64fa8fb79620f29adc5fdba1ee0d1a5d76dec445e9b6af648ac979cd15329d52bf04e54e05422b33063a7ccc6c4948df8b8c8b556c54ff150e439a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFFD8.tmp

Filesize
19KB

MD5
76b0b097e1c1e47d16e1763ae3182b25

SHA1
4e788e61dbd60a93d57d13ffb11248230955bca8

SHA256
687ee190d0ec62653754e6e90352cdb44bcfad878b026cf227e77c3a8894c24e

SHA512
36e9652e46ecab832176dba3a34812a44e0af1681f95731d910a7984796c40a26ecbdff97ae0488a98911baa475561bbe9af696ba2cfe31bb719d03526e6b156

Download Submit
memory/3792-7-0x0000000007C30000-0x0000000007D3A000-memory.dmp

Filesize
1.0MB

Download
memory/3792-199-0x00000000002D0000-0x0000000000748000-memory.dmp

Filesize
4.5MB

Download
memory/3792-13-0x00000000094B0000-0x0000000009526000-memory.dmp

Filesize
472KB

Download
memory/3792-12-0x0000000009410000-0x00000000094A2000-memory.dmp

Filesize
584KB

Download
memory/3792-11-0x000000000A0F0000-0x000000000A694000-memory.dmp

Filesize
5.6MB

Download
memory/3792-10-0x0000000008EA0000-0x0000000008F06000-memory.dmp

Filesize
408KB

Download
memory/3792-9-0x0000000009610000-0x0000000009B3C000-memory.dmp

Filesize
5.2MB

Download
memory/3792-8-0x0000000008F10000-0x00000000090D2000-memory.dmp

Filesize
1.8MB

Download
memory/3792-0-0x00000000002D0000-0x0000000000748000-memory.dmp

Filesize
4.5MB

Download
memory/3792-14-0x00000000095B0000-0x00000000095CE000-memory.dmp

Filesize
120KB

Download
memory/3792-6-0x00000000079E0000-0x0000000007A2C000-memory.dmp

Filesize
304KB

Download
memory/3792-5-0x00000000079A0000-0x00000000079DC000-memory.dmp

Filesize
240KB

Download
memory/3792-4-0x0000000007940000-0x0000000007952000-memory.dmp

Filesize
72KB

Download
memory/3792-3-0x0000000007EB0000-0x00000000084C8000-memory.dmp

Filesize
6.1MB

Download
memory/3792-2-0x00000000002D0000-0x0000000000748000-memory.dmp

Filesize
4.5MB

Download
memory/3792-1-0x00000000002D0000-0x0000000000748000-memory.dmp

Filesize
4.5MB

Download
memory/3792-369-0x00000000002D0000-0x0000000000748000-memory.dmp

Filesize
4.5MB

Download