General
-
Target
plc-password-setup-t_rCqyQfiI.exe
-
Size
6.2MB
-
Sample
220716-gg86hsaaem
-
MD5
7250e3da80e7072cea98e23fe4041345
-
SHA1
f9853b72781bc82d6508ac978503ffdfa104b419
-
SHA256
7e1616589594ae5c4303abd3ebf73dbe38b7b3b454690670ddaba11530ab4bd8
-
SHA512
bbf776d9183315a721455dab747c3daf3be1b4ded5d018642c131f9770a9beffdaeaa30fd801100f7ae6086d7417240f6e1171944bb115e7fd86590e8638de63
Static task
static1
Malware Config
Extracted
redline
mixbasic1
185.215.113.70:21508
-
auth_value
b5b7790c71797786dfd950545c81e9fa
Targets
-
-
Target
plc-password-setup-t_rCqyQfiI.exe
-
Size
6.2MB
-
MD5
7250e3da80e7072cea98e23fe4041345
-
SHA1
f9853b72781bc82d6508ac978503ffdfa104b419
-
SHA256
7e1616589594ae5c4303abd3ebf73dbe38b7b3b454690670ddaba11530ab4bd8
-
SHA512
bbf776d9183315a721455dab747c3daf3be1b4ded5d018642c131f9770a9beffdaeaa30fd801100f7ae6086d7417240f6e1171944bb115e7fd86590e8638de63
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
2Install Root Certificate
1