General
-
Target
4355c228e17427a764df96301a586f75de53b22890a82c4d855dc8d795541bee
-
Size
298KB
-
Sample
211209-t4exeaebaj
-
MD5
fb74576efd1396c8e6456bbf55736b9d
-
SHA1
106da8bdf7845b3370ddd19b9a8e82add6c069b9
-
SHA256
4355c228e17427a764df96301a586f75de53b22890a82c4d855dc8d795541bee
-
SHA512
20b479f2887b1a0f3296c13cf8075fbf778a82ba6c7b2f8cf60838f22f1c6192429764a62b396c7dc4a44df4cc1a56a0d0dbd035f54c90c5594c00afe1b4c1b2
Static task
static1
Behavioral task
behavioral1
Sample
4355c228e17427a764df96301a586f75de53b22890a82c4d855dc8d795541bee.exe
Resource
win10-en-20211208
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Targets
-
-
Target
4355c228e17427a764df96301a586f75de53b22890a82c4d855dc8d795541bee
-
Size
298KB
-
MD5
fb74576efd1396c8e6456bbf55736b9d
-
SHA1
106da8bdf7845b3370ddd19b9a8e82add6c069b9
-
SHA256
4355c228e17427a764df96301a586f75de53b22890a82c4d855dc8d795541bee
-
SHA512
20b479f2887b1a0f3296c13cf8075fbf778a82ba6c7b2f8cf60838f22f1c6192429764a62b396c7dc4a44df4cc1a56a0d0dbd035f54c90c5594c00afe1b4c1b2
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies RDP port number used by Windows
-
Sets DLL path for service in the registry
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-