General
-
Target
iu35ryECDcB7YnmA9O.exe
-
Size
854KB
-
Sample
211105-g2bezsfhaj
-
MD5
6160d9cc6de5bd6d63abf3a90492f72b
-
SHA1
b37c3ef6fc4c4af664ba0b8dbaaeb065988980d5
-
SHA256
6542a64376516f4aa87b9dd2cb2978b6e83441964110aa291d7a04bceb511d97
-
SHA512
f5ef576b2b5de73b6287be8b49454072744afae2e233e3efaf6666f8509472339eb8d9123220b8b1fbe4100b76f51777294551afa3dab8c095b71e2f51414c08
Static task
static1
Behavioral task
behavioral1
Sample
iu35ryECDcB7YnmA9O.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
iu35ryECDcB7YnmA9O.exe
Resource
win11
Behavioral task
behavioral3
Sample
iu35ryECDcB7YnmA9O.exe
Resource
win10-en-20211014
Malware Config
Extracted
redline
031121
m360li.info:81
Targets
-
-
Target
iu35ryECDcB7YnmA9O.exe
-
Size
854KB
-
MD5
6160d9cc6de5bd6d63abf3a90492f72b
-
SHA1
b37c3ef6fc4c4af664ba0b8dbaaeb065988980d5
-
SHA256
6542a64376516f4aa87b9dd2cb2978b6e83441964110aa291d7a04bceb511d97
-
SHA512
f5ef576b2b5de73b6287be8b49454072744afae2e233e3efaf6666f8509472339eb8d9123220b8b1fbe4100b76f51777294551afa3dab8c095b71e2f51414c08
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Registers COM server for autorun
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-