General
-
Target
B376E4858ECE14F0459FC8F24E72BED8.exe
-
Size
4.3MB
-
Sample
210820-x42jpm4d12
-
MD5
b376e4858ece14f0459fc8f24e72bed8
-
SHA1
c9e9321fc4d550ef75ca83deb1cdbd2d235c9fd9
-
SHA256
0a823cbd6a32a10c927253fa40466c8a3177e487ee7895a8a2e244a9b4c415fc
-
SHA512
0c9ae6c6aec36cc6e323a8d8ff9c3297bc60d8c29428d2d2f9674b7f7734ecb7211754fb5445d3280156b8252d7e51da3281dde8e367d9c735208229a29b795c
Static task
static1
Behavioral task
behavioral1
Sample
B376E4858ECE14F0459FC8F24E72BED8.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
B376E4858ECE14F0459FC8F24E72BED8.exe
Resource
win10v20210410
Malware Config
Extracted
redline
pab3
185.215.113.15:61506
Extracted
vidar
40.1
937
https://eduarroma.tumblr.com/
-
profile_id
937
Extracted
vidar
40
706
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
redline
Second_7.5K
45.14.49.200:27625
Extracted
vidar
40.1
983
https://eduarroma.tumblr.com/
-
profile_id
983
Targets
-
-
Target
B376E4858ECE14F0459FC8F24E72BED8.exe
-
Size
4.3MB
-
MD5
b376e4858ece14f0459fc8f24e72bed8
-
SHA1
c9e9321fc4d550ef75ca83deb1cdbd2d235c9fd9
-
SHA256
0a823cbd6a32a10c927253fa40466c8a3177e487ee7895a8a2e244a9b4c415fc
-
SHA512
0c9ae6c6aec36cc6e323a8d8ff9c3297bc60d8c29428d2d2f9674b7f7734ecb7211754fb5445d3280156b8252d7e51da3281dde8e367d9c735208229a29b795c
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Vidar Stealer
-
XMRig Miner Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-