Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99b54b89a995b9e87fa1a57b27f8d5293626a66c496ee5bea3b28fcf544b4e51

  • Size

    1.4MB

  • Sample

    231101-1xy52adf7w

  • MD5

    682bdf0725f207c6cb262d974e50454a

  • SHA1

    6c9298ce190dcaffe910884f4234a2482bd61430

  • SHA256

    99b54b89a995b9e87fa1a57b27f8d5293626a66c496ee5bea3b28fcf544b4e51

  • SHA512

    5ae9c1e1e3e2e3755868118df7916e4f2b6e259e93a838282e480c72027a246c2cfb16b0652165eb369f2f000a1a333e365aed801a4c5d04a63f5002e171d9fb

  • SSDEEP

    24576:Dy5xXzb1RnzpcJUqtJXP6bVzDX4ltquFV9hQ/w/iIn6ta0EcqnS3OmJP:W5Nv5cSqtJXP6bVQFLhtiIn6rh0Bm

Score
10/10
redlinesmokeloadergromekinzabackdoorpaypalevasioninfostealerpersistencephishingtrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Targets

    • Target

      99b54b89a995b9e87fa1a57b27f8d5293626a66c496ee5bea3b28fcf544b4e51

    • Size

      1.4MB

    • MD5

      682bdf0725f207c6cb262d974e50454a

    • SHA1

      6c9298ce190dcaffe910884f4234a2482bd61430

    • SHA256

      99b54b89a995b9e87fa1a57b27f8d5293626a66c496ee5bea3b28fcf544b4e51

    • SHA512

      5ae9c1e1e3e2e3755868118df7916e4f2b6e259e93a838282e480c72027a246c2cfb16b0652165eb369f2f000a1a333e365aed801a4c5d04a63f5002e171d9fb

    • SSDEEP

      24576:Dy5xXzb1RnzpcJUqtJXP6bVzDX4ltquFV9hQ/w/iIn6ta0EcqnS3OmJP:W5Nv5cSqtJXP6bVQFLhtiIn6rh0Bm

    Score
    10/10
    redlinesmokeloadergromekinzabackdoorpaypalevasioninfostealerpersistencephishingtrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand paypal.

      phishingpaypal

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks