Overview

overview

10

Static

static

P.O 2709_1.rtf

windows7-x64

10

P.O 2709_1.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P.O 2709_1.doc

  • Size

    11KB

  • Sample

    220928-qk384sgaa2

  • MD5

    a76a5beb83b71b2e1294d8489d7fbe41

  • SHA1

    2a4e957643195550640ad7b954afd26391d40b12

  • SHA256

    23318d0693ef4d2530719da58670c9ad00eddfaf18f50382bb3b55812e4f1a59

  • SHA512

    496ca014303cbc13ae925cad93422c3bec54159a869a7f5cc8b5e4a33c564cad2b43cae398fd9eb228879ebe991ae54c0c7338effd6b7821cf54e995883e4350

  • SSDEEP

    192:zNkjAI4TlUbrRi1uPjRKNS1zqdQtN40e3PHVsy898w3dFrlpRiFkK8Fmlq51T9:z4h4T2bQYrRRacBy898w3dBRIkDwg1h

Score
10/10
redlinesirusinfostealer

Malware Config

Extracted

Family

redline

Botnet

sirus

C2

147.124.223.126:4444

Targets

    • Target

      P.O 2709_1.doc

    • Size

      11KB

    • MD5

      a76a5beb83b71b2e1294d8489d7fbe41

    • SHA1

      2a4e957643195550640ad7b954afd26391d40b12

    • SHA256

      23318d0693ef4d2530719da58670c9ad00eddfaf18f50382bb3b55812e4f1a59

    • SHA512

      496ca014303cbc13ae925cad93422c3bec54159a869a7f5cc8b5e4a33c564cad2b43cae398fd9eb228879ebe991ae54c0c7338effd6b7821cf54e995883e4350

    • SSDEEP

      192:zNkjAI4TlUbrRi1uPjRKNS1zqdQtN40e3PHVsy898w3dFrlpRiFkK8Fmlq51T9:z4h4T2bQYrRRacBy898w3dBRIkDwg1h

    Score
    10/10
    redlinesirusinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks