Overview

overview

10

Static

static

1

NewInvoice.hta

windows7-x64

3

NewInvoice.hta

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NewInvoice.hta

  • Size

    33KB

  • Sample

    230612-rm8r2sda7x

  • MD5

    bd67157d85b0a64283578d60f413d8e6

  • SHA1

    a8ad3bb2fd9739e788b5818e3afc0f419efb5886

  • SHA256

    a0450c79462df181c6d792a1a1dd75b4ffe9187a89984c6edd44a3aa59234c0c

  • SHA512

    0c25e1bdd2e3bd6e45385b030f5e5d2b740277a9e9f07ab319d869d97c2a83825869fe5d08154c3ab5091d834b1ee8e85901e75002066ab16a4043b2c901945b

  • SSDEEP

    768:Wjs8sWFSWGWwiWfwAYcDuxxYMJO9zYGIfWkdYQj5vZ5i:WjdsWFSWGWbWfwAYcDuxxM9sGIfWYYQ8

Score
10/10
redlinediscoveryevasioninfostealerspywarestealertrojan

Malware Config

Targets

    • Target

      NewInvoice.hta

    • Size

      33KB

    • MD5

      bd67157d85b0a64283578d60f413d8e6

    • SHA1

      a8ad3bb2fd9739e788b5818e3afc0f419efb5886

    • SHA256

      a0450c79462df181c6d792a1a1dd75b4ffe9187a89984c6edd44a3aa59234c0c

    • SHA512

      0c25e1bdd2e3bd6e45385b030f5e5d2b740277a9e9f07ab319d869d97c2a83825869fe5d08154c3ab5091d834b1ee8e85901e75002066ab16a4043b2c901945b

    • SSDEEP

      768:Wjs8sWFSWGWwiWfwAYcDuxxYMJO9zYGIfWkdYQj5vZ5i:WjdsWFSWGWbWfwAYcDuxxM9sGIfWYYQ8

    Score
    10/10
    redlinediscoveryevasioninfostealerspywarestealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • UAC bypass

      evasiontrojan

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks