General
-
Target
setup.scr.exe
-
Size
622KB
-
Sample
230225-s7l98adf57
-
MD5
4a35d67996cdcde8da42ba8e40015738
-
SHA1
21342be12a055a2c1caffd73cc7866c81cb3e585
-
SHA256
76a794c86b0f80ae8ec3461e05e0fb0fb219e57f7e85ebdae3cc10901a99791c
-
SHA512
96f3904de25540397b1a499828f1781c943ffba4d42e2028b6ab322dbb3916bc03adf5ca084bf2afa3a90272a9c986e7d11b23e26ab86856225b0d0aef9f8ad2
-
SSDEEP
12288:U/C3Xp1sthiBKo+NJv9B3K6EwC2EQcmowOmA9BRMsrLS3t5r0I1Uu:e+Xp14hiBr+NJDvEwFQBPMqLS3kIC
Static task
static1
Behavioral task
behavioral1
Sample
setup.scr.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.scr.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7B
LWRTX
20.199.101.68:3161
LWRTX
-
delay
3
-
install
false
-
install_file
LWRTX
-
install_folder
%AppData%
Targets
-
-
Target
setup.scr.exe
-
Size
622KB
-
MD5
4a35d67996cdcde8da42ba8e40015738
-
SHA1
21342be12a055a2c1caffd73cc7866c81cb3e585
-
SHA256
76a794c86b0f80ae8ec3461e05e0fb0fb219e57f7e85ebdae3cc10901a99791c
-
SHA512
96f3904de25540397b1a499828f1781c943ffba4d42e2028b6ab322dbb3916bc03adf5ca084bf2afa3a90272a9c986e7d11b23e26ab86856225b0d0aef9f8ad2
-
SSDEEP
12288:U/C3Xp1sthiBKo+NJv9B3K6EwC2EQcmowOmA9BRMsrLS3t5r0I1Uu:e+Xp14hiBr+NJDvEwFQBPMqLS3kIC
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-