Overview

overview

10

Static

static

1

44cda0c892...47.exe

windows7-x64

10

44cda0c892...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44cda0c89226270d6ea6d3e4fce68247.exe

  • Size

    876KB

  • Sample

    240430-xhgewsfc84

  • MD5

    44cda0c89226270d6ea6d3e4fce68247

  • SHA1

    f812847510b41244da3cedc928ac805154872ae0

  • SHA256

    ebde60210d709f94cd3049159931e37d4ce84d9e8ea9b464cdfe76de3735f007

  • SHA512

    958f24388469963c2a3cde1a9e557d9fff87a8f024788b3ec88a9462b7433185cef8ef0af2196b5945ed6611ca4a7bd889adb670ee545c81748fbfdc3da415fc

  • SSDEEP

    24576:2NaQetypa7reXTnhUDhKPQrEC/55g4RwmwZaJw3rJy3:moreXLaAPiR/RwhZaG39M

Score
10/10
redlinenewdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

new

C2

91.92.249.182:34419

Targets

    • Target

      44cda0c89226270d6ea6d3e4fce68247.exe

    • Size

      876KB

    • MD5

      44cda0c89226270d6ea6d3e4fce68247

    • SHA1

      f812847510b41244da3cedc928ac805154872ae0

    • SHA256

      ebde60210d709f94cd3049159931e37d4ce84d9e8ea9b464cdfe76de3735f007

    • SHA512

      958f24388469963c2a3cde1a9e557d9fff87a8f024788b3ec88a9462b7433185cef8ef0af2196b5945ed6611ca4a7bd889adb670ee545c81748fbfdc3da415fc

    • SSDEEP

      24576:2NaQetypa7reXTnhUDhKPQrEC/55g4RwmwZaJw3rJy3:moreXLaAPiR/RwhZaG39M

    Score
    10/10
    redlinenewdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks