redline | 1503f2e404478dc43ea0e311a4df610d1c20fb553f6925e39301a7de17529454

Analysis

max time kernel
108s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2025 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe
Size

4.5MB
MD5

b631b2198b2c67e7052bbf17d1ce2651
SHA1

c0fe93eb842494177f99a10276bcd2fb67ec5e91
SHA256

1503f2e404478dc43ea0e311a4df610d1c20fb553f6925e39301a7de17529454
SHA512

60778c247e00fe42574911aa84baf1748428a17eec35214414c00b391d2dfe4c617963df4e53e8c32e746db27f1a2e1269f8f8d5d1c3ac481054a445ca4d645c
SSDEEP

49152:BRrBR6Yu++GZu/6MB6JFqv7j6SUZJPqyhWzXRU6l3rIDUmGhgscIa:BRNR6Yu+Y/6X/qv7jaFFIlcDUBa/I

Score

10^/10

redline sectoprat cheat discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

103.84.89.222:33791

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2884-1-0x00000000000B0000-0x0000000000528000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe
2884	824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe

C:\Users\Admin\AppData\Local\Temp\824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe
"C:\Users\Admin\AppData\Local\Temp\824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1F4C.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F61.tmp

Filesize
114KB

MD5
53428880544e432e120393b0d29a9d98

SHA1
79e83052cec9e53ae844a0560e276d9d533266ff

SHA256
77b1634d58777813a41a1742c4ebcd8fc77224d2ea338ad54addccc725ba8f84

SHA512
531df37448081d2d3447f20dd2bf96d183019db3fbdfeab8ae7b6c63e8778864ada03518f63d7b7fa9633069a28ba0e343efc4e7e4c33a158012c7e9409c1398

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F8D.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1FA2.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1FB8.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1FE3.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2215.tmp

Filesize
12KB

MD5
33507f612ae8b7b535d5a8a646583260

SHA1
62dfffc6d5f3d23758f6213c54442acf06e0fc98

SHA256
640448df51fdf5030b883aaaa6f860582b5303f7a49c4347de5da0ae95f240a5

SHA512
975526429e1bc35633811ef51f53d05712fd5535d88c141ab39ace77522adea762d43c2954e24ee9ccfbd9017ee3f9e3434eb96aad76a8fe293b45b71050de78

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2216.tmp

Filesize
15KB

MD5
fe16a17ab06932fb2a49d7afa4750523

SHA1
816b50c728d7ba06062b72572cf3b9bbf13ee124

SHA256
0c15a9aab4dd21e18641b87bb83703fdeda9fe1852e964d41266cb702f4dc734

SHA512
c8ba96c08f51e088d14f1936f01fa8e7aac8c4bdba02d03aa5a89732aa153dcbbfe6a072b42224676682d3e06a223ad8dced0d2027dc9b3b51879d2fffd9b138

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2228.tmp

Filesize
19KB

MD5
64cf551230652b4c007cdeb141063825

SHA1
f0597f8bde36e43317aefb18524a77951d9b8b68

SHA256
09cf11dd0e70303998fb3b0b779e967573fa451ef4c8aeb6c6a1e9919a8dfa4c

SHA512
0bafb9d166cb6e73c308ba769976d29c6334519045bdfc5a015e5237bc6e2d912ea9ab339fe4a47fb67f958db2aac5170e8cff66a36ceaaf2f28dbb1a699330a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2229.tmp

Filesize
875KB

MD5
344b61efaa9fd94def2c35ec8c622d7f

SHA1
1669c8aabcadc96e88f00f96da807a53af19a69e

SHA256
65349b2d3ee542a15a211465567568e403554924794ba801e931d3789a340752

SHA512
4c0729abef2b94e18841b6a1f51f3064295319769a70303468c20225fa78923352223a5ac45a28111c43cc390661f66467be041636764b3f0df237b8075ec07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp224A.tmp

Filesize
1.1MB

MD5
d63e3a3488ffcd8836fb100f58b2f3b6

SHA1
b43c98cbd57b3c5c6a220f0cc00283dd3620adfa

SHA256
00e140a9c0643d93508ea8a5963c9984fbfaa1ccc39f09ae3c52f916f9b9cb97

SHA512
cdb96675ae80b0c52107e290f5ea7c3b33715e90d7a14787ee985fc17e150b49e176de760e08bdafc7eb8eef3d3927516a6c290084f84e58000e0adcc4d065e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2291.tmp

Filesize
952KB

MD5
ed98a41335ffa89f495435c7fc4c471e

SHA1
589436f629495859bc2b101d9e6b9a4897139f7d

SHA256
a9d63ea2a21bc36924829028ed7dda61c195a6caae8e1d7654645eed6eda0f9d

SHA512
9a52411edaf034d0ddd58f80d7c5efb8ea170706cb373602ecfef2f090f43a1f9866b7db1d1437e6d472358f549d1ef9b63c34e05e22a4be2ce02dbc184c6d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2310.tmp

Filesize
10KB

MD5
d4f552f1371692faa382332ac114d04b

SHA1
449a0377667f70a6657eebb76e2f53d3cb165ce0

SHA256
4d83696056fcfe794da68602dec282d405ae2045ef0717216c9dfaa2a78a7a02

SHA512
b0f238e8f48a34f3a9bd7b319f6980631265686c9472ca273cc227ec6360358e58483fe5bb25c0283d43c6c3b55ba42dc0f62380fa506e03cc41ba1417dbfb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp234E.tmp

Filesize
476KB

MD5
20eda928f8b66a151775afa075aa9f12

SHA1
2d54ddc54f31340120c136e99779e68eb73e5fc3

SHA256
ef4f1ea860ca25ef48c8c80c914968582a0f00e2c0381679861e11de90055dc9

SHA512
c63bd02c3bdf75d314c85631a2c1493d56279d861b04e69a84901c8aff5cfa2068bbff2c59c2d007e525f49550dd4b45c0456d6d17bf7a89323de66cb4e7d4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp235E.tmp

Filesize
18KB

MD5
060e8172199ac30cab967289ede66191

SHA1
072e82c59fd4ab69aa259dcac34ba7991c2cbe4e

SHA256
556e73c0aeba7ab0fe92117d372ca1c95bcf8e2473d0ccabc3decd372572f194

SHA512
116c60d38c1934a0a569535a5d6e9a68611cf5d4a6d1127de21a70b3860de5dfe6895eaa8ed0db735cb882494434a1c1e020d5a3414040b8239ccffd09134319

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2360.tmp

Filesize
15KB

MD5
f53a452a54e7cec19a84896bfcc7cf5e

SHA1
c5f397d024d8a611fff5ad6bcace7ccac39ee9a9

SHA256
981c0927ec51908c72369c33bec2f9f92aaaaacb03a9fbd6fc57a577c2077246

SHA512
5366ca883e26d1ac7de9b0058d8e7d905176a76662c6961e3edc965c9376e43aedaed4337f327be8b7c601f2a0d17989ac8c3138ea0820a01974219a09111a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2361.tmp

Filesize
533KB

MD5
c55db5c2ff15b8e97849922f255e385c

SHA1
a85bf86f480387635f2078caedf95ad26f4b6437

SHA256
47b3890e916967489746f8f83aef66328bc2b91abf30b1f342209644e31e6434

SHA512
1e3e03a4ee2a7cd226f79624a0586e6b503f27f381ecd98cee2520a39094cef50ff0de31505a83c94f6e92a23cae11c6df263a577a9fae9120b494314b4f4e7d

Download Submit
memory/2884-8-0x0000000006470000-0x0000000006632000-memory.dmp

Filesize
1.8MB

Download
memory/2884-165-0x0000000007650000-0x0000000007BF4000-memory.dmp

Filesize
5.6MB

Download
memory/2884-164-0x0000000006640000-0x00000000066A6000-memory.dmp

Filesize
408KB

Download
memory/2884-9-0x0000000006B70000-0x000000000709C000-memory.dmp

Filesize
5.2MB

Download
memory/2884-0-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2884-7-0x0000000005190000-0x000000000529A000-memory.dmp

Filesize
1.0MB

Download
memory/2884-6-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2884-5-0x0000000004F30000-0x0000000004F7C000-memory.dmp

Filesize
304KB

Download
memory/2884-4-0x0000000004EF0000-0x0000000004F2C000-memory.dmp

Filesize
240KB

Download
memory/2884-3-0x0000000004E90000-0x0000000004EA2000-memory.dmp

Filesize
72KB

Download
memory/2884-2-0x0000000005450000-0x0000000005A68000-memory.dmp

Filesize
6.1MB

Download
memory/2884-1-0x00000000000B0000-0x0000000000528000-memory.dmp

Filesize
4.5MB

Download
memory/2884-364-0x0000000007520000-0x0000000007596000-memory.dmp

Filesize
472KB

Download
memory/2884-365-0x0000000009C00000-0x0000000009C92000-memory.dmp

Filesize
584KB

Download
memory/2884-367-0x0000000007620000-0x000000000763E000-memory.dmp

Filesize
120KB

Download
memory/2884-366-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/2884-368-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download