General

  • Target

    01327699.exe

  • Size

    783KB

  • Sample

    230615-n7676sgd52

  • MD5

    fea55b6c8a5de00f47d6f12e6810f44c

  • SHA1

    b5679b3d5a2da64495877bd29ab1789990bdca7a

  • SHA256

    c21f93092496c6d0b8bc09fa3a2005242bf0b46dd82383acd4ff1b9be546aceb

  • SHA512

    ad7b73dfaf41c6e4c7d1d92518f0ba0bda55e55e02fcc1c3cb6c96c1c8f1de684aba73d97f9a6720877a8dc1ce32025fcfa2494ee8e9a3e59d3a939c9d1252df

  • SSDEEP

    24576:eyiRZBA1iFLLG9xKyj6TCnW4dfsUcO6l:tOBA4h6Sy+WW0fsUcO

Malware Config

Extracted

Family

redline

Botnet

rovno

C2

83.97.73.130:19061

Attributes
  • auth_value

    88306b072bfae0d9e44ed86a222b439d

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.130:19061

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

dana

C2

83.97.73.130:19061

Attributes
  • auth_value

    da2d1691db653e49676d799e1eae2673

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes
  • auth_value

    a98d303cc28bb3b32a23c59214ae3bc0

Targets

    • Target

      01327699.exe

    • Size

      783KB

    • MD5

      fea55b6c8a5de00f47d6f12e6810f44c

    • SHA1

      b5679b3d5a2da64495877bd29ab1789990bdca7a

    • SHA256

      c21f93092496c6d0b8bc09fa3a2005242bf0b46dd82383acd4ff1b9be546aceb

    • SHA512

      ad7b73dfaf41c6e4c7d1d92518f0ba0bda55e55e02fcc1c3cb6c96c1c8f1de684aba73d97f9a6720877a8dc1ce32025fcfa2494ee8e9a3e59d3a939c9d1252df

    • SSDEEP

      24576:eyiRZBA1iFLLG9xKyj6TCnW4dfsUcO6l:tOBA4h6Sy+WW0fsUcO

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks