Overview

overview

10

Static

static

3

Bandicam v...58.exe

windows7-x64

10

Bandicam v...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ede8d795cc7869a18747f015bd1627643f25f88ba41b9ea8766915fe28fef07

  • Size

    32.2MB

  • Sample

    240525-tcdj9sab69

  • MD5

    b52cbd0d8375b31a381ba9bd4b1da468

  • SHA1

    6bd74dbcb16ba89237cf12728419d647efe048c5

  • SHA256

    2ede8d795cc7869a18747f015bd1627643f25f88ba41b9ea8766915fe28fef07

  • SHA512

    f1029c0d165ac3cd37a44c2b43a538cb43221c21e2a69b2c87f7de6705b1f567552db21c0e50225c868b0ae83d8a3700b71a3f5729f7c5b4d49917ccd4ca361b

  • SSDEEP

    786432:I7p9ZTTkUTPn6vvr0eeK3kyJr2HChFEspHosaAT4o5:yTTkUTPn6vvw/KUyJrwahpHt6o5

Score
10/10
redlineyt-16.05.2024discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

YT-16.05.2024

C2

45.140.147.183:12245

Targets

    • Target

      Bandicam v7.1/Bandicam_v7.1.1.2158.exe

    • Size

      32.7MB

    • MD5

      4984e0c775ab5231a365b1a1c202a426

    • SHA1

      738e02162caf70a354c6ae9a4509464e04c7359c

    • SHA256

      0af3e262f17ec535175470767fa2133232bfe5c6cdb4decdae442282b68aa086

    • SHA512

      c78d51f81968e4112a3ad2e6a14d37f4331504cedb156cdcc9610de13ada1405f326fdae850c75981ea22d33605d38619c9d23942a7f2b5b3f7e8609428fafcd

    • SSDEEP

      786432:s205KPk4uyH7/DQKcGF5snXw2QYSpxrDtG6j+P7ZqsAPcF5:sbSbvQ0F5T2QYIr5vj+vAPG

    Score
    10/10
    redlineyt-16.05.2024discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks