General
-
Target
Bandicam v7.1.rar
-
Size
32.2MB
-
Sample
240525-s5fpnahd2w
-
MD5
b52cbd0d8375b31a381ba9bd4b1da468
-
SHA1
6bd74dbcb16ba89237cf12728419d647efe048c5
-
SHA256
2ede8d795cc7869a18747f015bd1627643f25f88ba41b9ea8766915fe28fef07
-
SHA512
f1029c0d165ac3cd37a44c2b43a538cb43221c21e2a69b2c87f7de6705b1f567552db21c0e50225c868b0ae83d8a3700b71a3f5729f7c5b4d49917ccd4ca361b
-
SSDEEP
786432:I7p9ZTTkUTPn6vvr0eeK3kyJr2HChFEspHosaAT4o5:yTTkUTPn6vvw/KUyJrwahpHt6o5
Static task
static1
Behavioral task
behavioral1
Sample
Bandicam v7.1/Bandicam_v7.1.1.2158.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Bandicam v7.1/Bandicam_v7.1.1.2158.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
redline
YT-16.05.2024
45.140.147.183:12245
Targets
-
-
Target
Bandicam v7.1/Bandicam_v7.1.1.2158.exe
-
Size
32.7MB
-
MD5
4984e0c775ab5231a365b1a1c202a426
-
SHA1
738e02162caf70a354c6ae9a4509464e04c7359c
-
SHA256
0af3e262f17ec535175470767fa2133232bfe5c6cdb4decdae442282b68aa086
-
SHA512
c78d51f81968e4112a3ad2e6a14d37f4331504cedb156cdcc9610de13ada1405f326fdae850c75981ea22d33605d38619c9d23942a7f2b5b3f7e8609428fafcd
-
SSDEEP
786432:s205KPk4uyH7/DQKcGF5snXw2QYSpxrDtG6j+P7ZqsAPcF5:sbSbvQ0F5T2QYIr5vj+vAPG
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1