Overview

overview

10

Static

static

1

f74d44fd46...93.exe

windows7-x64

10

f74d44fd46...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a76c5b96dc760f120ca5648ff469abd2.bin

  • Size

    643KB

  • Sample

    230329-b1wfwaga2w

  • MD5

    23f92a385718ab39521567df0d274b8d

  • SHA1

    e596f68f214fb268f251ee021898e2beea23cdb0

  • SHA256

    049777919d0f1c0b42295f679d24d427936f34bbd07167c66becf6c20e5345d8

  • SHA512

    a5438678b75a549ec2ccaa31dbc5f8f69fafb7ceec0c9e192422be92ff6e0a5f493940e0629a3c6de5bc668b72953555e83032748d5d469cf5a412607de4f08f

  • SSDEEP

    12288:DL2zctxYWt5QpDx2TGpUJTY7g2QDaSNnNvzfDXHq3Tvn7di5:DKwtGG5QpDQGj7g2+DNxDaXg

Score
10/10
redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Targets

    • Target

      f74d44fd46f445f4346eed0236faaa4b932e675b315dccffd1f4476d3559bc93.exe

    • Size

      686KB

    • MD5

      a76c5b96dc760f120ca5648ff469abd2

    • SHA1

      81242e373931fdfbcb947969d8e4bd4360654fb1

    • SHA256

      f74d44fd46f445f4346eed0236faaa4b932e675b315dccffd1f4476d3559bc93

    • SHA512

      6f72b077c775fc0bee9fd1b64aeb8970aa594b473a84a19e2e3bdf55b806a31a5db746b23ba30c96300919da473e6bd08e5c849bb257f90b8f4c5c90c13bb336

    • SSDEEP

      12288:EMrPy90UKsnoVh888guM/AhTzPyoJ0Fukp7qHOk40a2mFG6Z0U4oX0LquNeSnDjd:7yVKbVS8RuQAhnD0Fuk5JPYe+U4TqSnF

    Score
    10/10
    redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks