Malware sandboxing report by Hatching Triage

General

Target

edcb1e5d5fc952793cd6ed30262a5787d92655e7b6e09d6b186057e6b8e92d69
Size

12KB
Sample

220918-qvskcsbcf2
MD5

665a89d53afdaca17a8a3255a2c37b4e
SHA1

f988d7aa9c15fd002b1f7ab2a0a5fd273e592bbd
SHA256

edcb1e5d5fc952793cd6ed30262a5787d92655e7b6e09d6b186057e6b8e92d69
SHA512

7c57ea122646b4f44967c99e5cf52c8d62afa6d846bf65bcbbd8935e512136552e2d2af4cfdcb2b504c6ccd9a5c2d2a81de9992933a7c3d56f0407e18c0535eb
SSDEEP

192:bMXUSWUFL+SV/sDRI/yih5g9WuiEguKkyosMpp:UdL+SV/o6KOdhlosa

Score

10^/10

Malware Config

Extracted

Family	nanocore
Version	1.2.2.0
C2	95.70.139.81:54984 95.70.139.81:54984
Attributes	activate_away_mode false backup_connection_host 95.70.139.81 backup_dns_server 8.8.4.4 buffer_size 65535 build_time 2022-06-30T10:14:00.566684636Z bypass_user_account_control true bypass_user_account_control_data clear_access_control false clear_zone_identifier false connect_delay 4000 connection_port 54984 default_group Default enable_debug_mode true gc_threshold 1.048576e+07 keep_alive_timeout 30000 keyboard_logging false lan_timeout 2500 max_packet_size 1.048576e+07 mutex e4d3027f-8fb7-4ea0-9c1d-c3d2f2a203b5 mutex_timeout 5000 prevent_system_sleep false primary_connection_host 95.70.139.81 primary_dns_server 8.8.8.8 request_elevation false restart_delay 5000 run_delay 0 run_on_startup false set_critical_process false timeout_interval 5000 use_custom_dns_server false version 1.2.2.0 wan_timeout 8000

Extracted

Family	redline
Botnet	cheat
C2	51.103.25.183:12220 51.103.25.183:12220

Targets

- Target
  
  edcb1e5d5fc952793cd6ed30262a5787d92655e7b6e09d6b186057e6b8e92d69
- Size
  
  12KB
- MD5
  
  665a89d53afdaca17a8a3255a2c37b4e
- SHA1
  
  f988d7aa9c15fd002b1f7ab2a0a5fd273e592bbd
- SHA256
  
  edcb1e5d5fc952793cd6ed30262a5787d92655e7b6e09d6b186057e6b8e92d69
- SHA512
  
  7c57ea122646b4f44967c99e5cf52c8d62afa6d846bf65bcbbd8935e512136552e2d2af4cfdcb2b504c6ccd9a5c2d2a81de9992933a7c3d56f0407e18c0535eb
- SSDEEP
  
  192:bMXUSWUFL+SV/sDRI/yih5g9WuiEguKkyosMpp:UdL+SV/o6KOdhlosa
Score

10^/10

nanocore redline cheat evasion infostealer keylogger persistence spyware stealer trojan
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

System Information Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Tasks

static1

Score

N/A

behavioral1

nanocoreredlinecheatevasioninfostealerkeyloggerpersistencespywarestealertrojan

Score

10^/10

Sharing

General

Malware Config

Extracted

Extracted

Targets

NanoCore

RedLine

RedLine payload

Downloads MZ/PE file

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks

static1

behavioral1