Overview

overview

10

Static

static

d5a6f4ae6a...14.exe

windows7_x64

10

d5a6f4ae6a...14.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5a6f4ae6a3c00252f1fe0a2aa69cc8327d722f6cf69388ad26f52428076fa14.exe

  • Size

    8.2MB

  • Sample

    210505-s1r3kyf766

  • MD5

    5b6110f5767aba1d8f06be7f854250e9

  • SHA1

    31e9a270b849ce51ecdd274ae72c4be2490322fa

  • SHA256

    d5a6f4ae6a3c00252f1fe0a2aa69cc8327d722f6cf69388ad26f52428076fa14

  • SHA512

    c8fed779968482653c4b40c66692f796489b04f9d692ecb209a03c6470c27163adfa3cbf9cbfe3c963c6841a74499ee443882ed0dea9c2901f33a58c54c3683c

Score
10/10
redlineeumix4evasioninfostealerpersistencespywarestealer

Malware Config

Extracted

Family

redline

Botnet

eumix4

C2

crownnest.cyou:80

Targets

    • Target

      d5a6f4ae6a3c00252f1fe0a2aa69cc8327d722f6cf69388ad26f52428076fa14.exe

    • Size

      8.2MB

    • MD5

      5b6110f5767aba1d8f06be7f854250e9

    • SHA1

      31e9a270b849ce51ecdd274ae72c4be2490322fa

    • SHA256

      d5a6f4ae6a3c00252f1fe0a2aa69cc8327d722f6cf69388ad26f52428076fa14

    • SHA512

      c8fed779968482653c4b40c66692f796489b04f9d692ecb209a03c6470c27163adfa3cbf9cbfe3c963c6841a74499ee443882ed0dea9c2901f33a58c54c3683c

    Score
    10/10
    redlineeumix4evasioninfostealerpersistencespywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Modifies RDP port number used by Windows

    • Modifies Windows Firewall

      evasion

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Account Manipulation

1
T1098

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Remote Desktop Protocol

1
T1076

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks