redline

General

Target

corel_601486237.exe
Size

3.3MB
Sample

210318-lg8d2m9sjn
MD5

00f9f139f9e45206bab0a7fd19ed076d
SHA1

ad720c880fd41de2130b740b8dd0da94f65d47c3
SHA256

7d9aafb68434ef5d48f52a130a35c4b1c9913f85cf22c3fd4c1baf07a226a94c
SHA512

f592d1e206b0bed47606d1a6807972fa39f2bba5bd8c5aab7249b6942b19c6a47c48b672c199ad823f46b8c82714d1642f2b1daccda4cbaefb16ccecde0ee063

Score

10^/10

Malware Config

Targets

- Target
  
  corel_601486237.exe
- Size
  
  3.3MB
- MD5
  
  00f9f139f9e45206bab0a7fd19ed076d
- SHA1
  
  ad720c880fd41de2130b740b8dd0da94f65d47c3
- SHA256
  
  7d9aafb68434ef5d48f52a130a35c4b1c9913f85cf22c3fd4c1baf07a226a94c
- SHA512
  
  f592d1e206b0bed47606d1a6807972fa39f2bba5bd8c5aab7249b6942b19c6a47c48b672c199ad823f46b8c82714d1642f2b1daccda4cbaefb16ccecde0ee063
Score

10^/10

redline discovery infostealer persistence upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Suspicious use of NtCreateProcessExOtherParentProcess
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Blocklisted process makes network request
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2