General

  • Target

    ce8db50913eff9d4e600312d7c446b4a

  • Size

    691KB

  • Sample

    211223-knrrlaabbm

  • MD5

    ce8db50913eff9d4e600312d7c446b4a

  • SHA1

    6ed1b7efb1acb82b5856824a66b0a70af319109f

  • SHA256

    93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd

  • SHA512

    74f979d6678ab68b6063b8497f37303d41c0f084ee198d0260fd90fc28aa8a1e1cc55a8bcd65cff7c05338bc93e23b33767efa1d0c8974a1a3039916835d05e4

Malware Config

Extracted

Family

redline

Botnet

runpe

C2

142.202.242.172:7667

Targets

    • Target

      ce8db50913eff9d4e600312d7c446b4a

    • Size

      691KB

    • MD5

      ce8db50913eff9d4e600312d7c446b4a

    • SHA1

      6ed1b7efb1acb82b5856824a66b0a70af319109f

    • SHA256

      93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd

    • SHA512

      74f979d6678ab68b6063b8497f37303d41c0f084ee198d0260fd90fc28aa8a1e1cc55a8bcd65cff7c05338bc93e23b33767efa1d0c8974a1a3039916835d05e4

    • DarkVNC

      DarkVNC is a malicious version of the famous VNC software.

    • Detect Neshta Payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • DarkVNC Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks