Overview

overview

10

Static

static

Wizard Loader.exe

windows7_x64

10

Wizard Loader.exe

windows10_x64

9

Wizard Loader.exe

windows11_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Wizard Loader.exe

  • Size

    12.2MB

  • Sample

    220118-yjlaxachfr

  • MD5

    d81339bceaf855749edcdc71aee5a0c0

  • SHA1

    4ae534a44cb7cde94b9e9619ea4be6397b97b6d7

  • SHA256

    aef29bb9fdd5a886dea3fd46654827237e2ddf77c91921fcf0b356b61fd458c1

  • SHA512

    f15c57de5dc997143785ab3e320adcd6db951747f6532c0f8e20c9ad93e7545575012f2a2534f77d382593cb20b9e8e97624022dd93ebdf9aa5269bad47d45c3

Score
10/10
redlineevasioninfostealerransomwarestealerthemidatrojan

Malware Config

Targets

    • Target

      Wizard Loader.exe

    • Size

      12.2MB

    • MD5

      d81339bceaf855749edcdc71aee5a0c0

    • SHA1

      4ae534a44cb7cde94b9e9619ea4be6397b97b6d7

    • SHA256

      aef29bb9fdd5a886dea3fd46654827237e2ddf77c91921fcf0b356b61fd458c1

    • SHA512

      f15c57de5dc997143785ab3e320adcd6db951747f6532c0f8e20c9ad93e7545575012f2a2534f77d382593cb20b9e8e97624022dd93ebdf9aa5269bad47d45c3

    Score
    10/10
    redlineevasioninfostealerstealerthemidatrojanransomware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • rl_trojan

      redline stealer.

      stealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2
T1031

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Impair Defenses

1
T1562

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Defacement

1
T1491

Tasks