Overview

overview

10

Static

static

aad0024d7c...14.exe

windows7_x64

10

aad0024d7c...14.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aad0024d7c30bf6fee7c90d90371ca14.exe

  • Size

    37.0MB

  • Sample

    220609-yyt7csbgbp

  • MD5

    aad0024d7c30bf6fee7c90d90371ca14

  • SHA1

    a503d2586a3eab062b1696fc1602bae9faaeb221

  • SHA256

    69a22a0c352f37433ae833dcffed41e1b6d6c5aeefe6167aa4e0be3fe2f07e07

  • SHA512

    b8aa5a82c7b3366bc93dee6bfffbb6d5e6fefeff12d8073f8a86993e0a4c985fd88dd33ef87b89384cd094dc34444fc505bfcb3b90cc647bd01088692c3f970a

Score
10/10
redlinemaindiscoveryevasioninfostealerspywaretrojanupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://thddghdd3.com/hfile.bin

Extracted

Family

redline

Botnet

Main

C2

185.250.148.104:23290

Attributes
  • auth_value

    128a196090d81c16477a2ef82c42859f

Targets

    • Target

      aad0024d7c30bf6fee7c90d90371ca14.exe

    • Size

      37.0MB

    • MD5

      aad0024d7c30bf6fee7c90d90371ca14

    • SHA1

      a503d2586a3eab062b1696fc1602bae9faaeb221

    • SHA256

      69a22a0c352f37433ae833dcffed41e1b6d6c5aeefe6167aa4e0be3fe2f07e07

    • SHA512

      b8aa5a82c7b3366bc93dee6bfffbb6d5e6fefeff12d8073f8a86993e0a4c985fd88dd33ef87b89384cd094dc34444fc505bfcb3b90cc647bd01088692c3f970a

    Score
    10/10
    redlinemaindiscoveryevasioninfostealerspywaretrojanupx

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies Windows Defender notification settings

      evasiontrojan

    • Modifies security service

      evasion

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

3
T1031

Scheduled Task

1
T1053

BITS Jobs

1
T1197

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

File Permissions Modification

1
T1222

BITS Jobs

1
T1197

Hidden Files and Directories

1
T1158

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks