Resubmissions

26-09-2022 01:16

220926-bms4laggg3 10

23-09-2022 06:37

220923-hdg4asddc7 10

General

  • Target

    661a6a25cbdbec6543e74fae455e349a.exe

  • Size

    926KB

  • Sample

    220926-bms4laggg3

  • MD5

    661a6a25cbdbec6543e74fae455e349a

  • SHA1

    c5486f079370b7a0b2c1dbd170035ce25da8163e

  • SHA256

    60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

  • SHA512

    b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b

  • SSDEEP

    12288:taxffztFbbNiQoNS+2pvdNbbM3wBirlBQYg3fLLD:taxHzvwQoNS+q/bbswBirPQYgvD

Malware Config

Extracted

Family

redline

Botnet

mag21

C2

jamesmillion.xyz:47481

Attributes
  • auth_value

    b5ecf039f4b13b472d3c95fc6fe41fc8

Targets

    • Target

      661a6a25cbdbec6543e74fae455e349a.exe

    • Size

      926KB

    • MD5

      661a6a25cbdbec6543e74fae455e349a

    • SHA1

      c5486f079370b7a0b2c1dbd170035ce25da8163e

    • SHA256

      60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0

    • SHA512

      b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b

    • SSDEEP

      12288:taxffztFbbNiQoNS+2pvdNbbM3wBirlBQYg3fLLD:taxHzvwQoNS+q/bbswBirPQYgvD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks