Overview

overview

10

Static

static

22F9967C01...F5.exe

windows7_x64

10

22F9967C01...F5.exe

windows10_x64

10

Resubmissions

10-05-2021 10:26

210510-51q2zwvjce 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22F9967C010BF3B752D56BCDEE846BF5.exe

  • Size

    612KB

  • Sample

    210510-51q2zwvjce

  • MD5

    22f9967c010bf3b752d56bcdee846bf5

  • SHA1

    688b82c1eb648ee5eea04042da253d77c706f945

  • SHA256

    d8a12da66c3b95e1f2dc9c7e5667a5baf7dbdbbaff01f342222dc696c07455fa

  • SHA512

    b4dfd895af0f98de30d6446e847e3451c8d8fa7a6571aaac7db3c0fd40febc982e52035af709db3bba68b0e19037ee71443863b25ed3d5dcc13bb0375d69c3c6

Score
10/10
redlinesource1evasioninfostealerspywaretrojan

Malware Config

Extracted

Family

redline

Botnet

source1

C2

199.195.251.96:43073

Targets

    • Target

      22F9967C010BF3B752D56BCDEE846BF5.exe

    • Size

      612KB

    • MD5

      22f9967c010bf3b752d56bcdee846bf5

    • SHA1

      688b82c1eb648ee5eea04042da253d77c706f945

    • SHA256

      d8a12da66c3b95e1f2dc9c7e5667a5baf7dbdbbaff01f342222dc696c07455fa

    • SHA512

      b4dfd895af0f98de30d6446e847e3451c8d8fa7a6571aaac7db3c0fd40febc982e52035af709db3bba68b0e19037ee71443863b25ed3d5dcc13bb0375d69c3c6

    Score
    10/10
    redlinesource1evasioninfostealerspywaretrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks