redline | 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
Size

558KB
MD5

a56b296b440dd37fdc820a79373ab0d9
SHA1

cc555a9ece05af0a60ebb89e5c392c6dbbedac4a
SHA256

3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a
SHA512

a3a6ef1824d75eacd0342a6d21b0f80bb247ccbbedebdba5e26d1cb04e5ef41be85f758957a5f704cae160e946c2757e0531b1466b0409ccc2c09bd5c2b53186
SSDEEP

12288:cvVX9Koe0T8l++GpoTp2AnNtYyTlOr3++yDuzK4Y/3vw:at7e0T8l+xpoTp2ANtzlOr3+B+4/3

Score

10^/10

redline sectoprat cheat execution infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

45.137.22.71:55615

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4884-22-0x0000000000400000-0x000000000041E000-memory.dmp family_redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat
SectopRAT payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4884-22-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2568 powershell.exe

resource	yara_rule
behavioral2/memory/4884-22-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

resource	yara_rule
behavioral2/memory/4884-22-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

pid	process
2568	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

description	pid	process	target process
PID 5092 set thread context of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2612 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2568 powershell.exe
2568 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exe3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

description pid process

Token: SeDebugPrivilege 2568 powershell.exe
Token: SeDebugPrivilege 4884 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

pid	process
2612	schtasks.exe

pid	process
2568	powershell.exe
2568	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	4884	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

description	pid	process	target process
PID 5092 wrote to memory of 2568	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	powershell.exe
PID 5092 wrote to memory of 2568	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	powershell.exe
PID 5092 wrote to memory of 2568	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	powershell.exe
PID 5092 wrote to memory of 2612	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	schtasks.exe
PID 5092 wrote to memory of 2612	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	schtasks.exe
PID 5092 wrote to memory of 2612	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	schtasks.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
PID 5092 wrote to memory of 4884	5092	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe	3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe

C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
"C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XGWXzz.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XGWXzz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE86.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
"C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe.log
Filesize
1KB

MD5
b7b9acb869ccc7f7ecb5304ec0384dee

SHA1
6a90751c95817903ee833d59a0abbef425a613b3

SHA256
8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

SHA512
7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fa4zmhyz.nwu.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEE86.tmp
Filesize
1KB

MD5
77991486e9841e61514b95457a1158b8

SHA1
4cf34bac823012c819225fc76e8b16e8986b00b3

SHA256
d851013106c622e26998a6b99e736507f3189f55c1a9d52c5e704b3c45740811

SHA512
b735f056586d9e588e44174a895f348ecc509f857f12105dbbada3003fe93a4d50324e8e563c8d85a0d4d4c09e9427f942290268c3523c930d7eca75f85d81a4

Download Submit
memory/2568-58-0x0000000006EE0000-0x0000000006F83000-memory.dmp

Filesize
652KB

Download
memory/2568-70-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2568-66-0x0000000007360000-0x000000000737A000-memory.dmp

Filesize
104KB

Download
memory/2568-67-0x0000000007340000-0x0000000007348000-memory.dmp

Filesize
32KB

Download
memory/2568-65-0x0000000007260000-0x0000000007274000-memory.dmp

Filesize
80KB

Download
memory/2568-64-0x0000000007250000-0x000000000725E000-memory.dmp

Filesize
56KB

Download
memory/2568-63-0x0000000007220000-0x0000000007231000-memory.dmp

Filesize
68KB

Download
memory/2568-62-0x00000000072A0000-0x0000000007336000-memory.dmp

Filesize
600KB

Download
memory/2568-61-0x0000000007090000-0x000000000709A000-memory.dmp

Filesize
40KB

Download
memory/2568-59-0x0000000007670000-0x0000000007CEA000-memory.dmp

Filesize
6.5MB

Download
memory/2568-17-0x00000000023C0000-0x00000000023F6000-memory.dmp

Filesize
216KB

Download
memory/2568-60-0x0000000007020000-0x000000000703A000-memory.dmp

Filesize
104KB

Download
memory/2568-20-0x0000000004ED0000-0x00000000054F8000-memory.dmp

Filesize
6.2MB

Download
memory/2568-19-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2568-21-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2568-47-0x00000000713B0000-0x00000000713FC000-memory.dmp

Filesize
304KB

Download
memory/2568-24-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2568-57-0x00000000062A0000-0x00000000062BE000-memory.dmp

Filesize
120KB

Download
memory/2568-26-0x0000000004D40000-0x0000000004D62000-memory.dmp

Filesize
136KB

Download
memory/2568-28-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/2568-27-0x0000000005670000-0x00000000056D6000-memory.dmp

Filesize
408KB

Download
memory/2568-46-0x00000000062C0000-0x00000000062F2000-memory.dmp

Filesize
200KB

Download
memory/2568-44-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Filesize
120KB

Download
memory/4884-71-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4884-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4884-41-0x0000000005840000-0x0000000005852000-memory.dmp

Filesize
72KB

Download
memory/4884-42-0x00000000058D0000-0x000000000590C000-memory.dmp

Filesize
240KB

Download
memory/4884-43-0x0000000005910000-0x000000000595C000-memory.dmp

Filesize
304KB

Download
memory/4884-30-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/4884-45-0x0000000005B50000-0x0000000005C5A000-memory.dmp

Filesize
1.0MB

Download
memory/4884-40-0x0000000005EB0000-0x00000000064C8000-memory.dmp

Filesize
6.1MB

Download
memory/5092-6-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/5092-9-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/5092-3-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/5092-2-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/5092-12-0x0000000009D70000-0x0000000009DC8000-memory.dmp

Filesize
352KB

Download
memory/5092-11-0x00000000062E0000-0x00000000062F0000-memory.dmp

Filesize
64KB

Download
memory/5092-10-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-25-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-8-0x0000000007530000-0x000000000754C000-memory.dmp

Filesize
112KB

Download
memory/5092-7-0x0000000006300000-0x000000000639C000-memory.dmp

Filesize
624KB

Download
memory/5092-4-0x00000000057D0000-0x0000000005B24000-memory.dmp

Filesize
3.3MB

Download
memory/5092-5-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-1-0x0000000000B60000-0x0000000000BF0000-memory.dmp

Filesize
576KB

Download
memory/5092-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download