General
-
Target
caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4.exe
-
Size
3.2MB
-
Sample
240725-gqf64asdkl
-
MD5
b49ab1057d8a84fcfab28e98cfbf7330
-
SHA1
b5740a5eeef81280e7b7c9556487d3d5e21725f0
-
SHA256
caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4
-
SHA512
d2ba08fee9f409d9b994fa66ac2db1b28f87590ced2461bde6f776bb0289fc2dbdea1ff725bdfca12dd4caadfc15560b2dc5a5fb60578dbe517e60de7d2d6149
-
SSDEEP
98304:+9ckJgZJBx32c8a3TiHPBeZRuyO7AqY3UkWcT:+mRDiHPBeZBOc
Static task
static1
Behavioral task
behavioral1
Sample
caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
redline
MAD
185.189.14.66:4090
Targets
-
-
Target
caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4.exe
-
Size
3.2MB
-
MD5
b49ab1057d8a84fcfab28e98cfbf7330
-
SHA1
b5740a5eeef81280e7b7c9556487d3d5e21725f0
-
SHA256
caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4
-
SHA512
d2ba08fee9f409d9b994fa66ac2db1b28f87590ced2461bde6f776bb0289fc2dbdea1ff725bdfca12dd4caadfc15560b2dc5a5fb60578dbe517e60de7d2d6149
-
SSDEEP
98304:+9ckJgZJBx32c8a3TiHPBeZRuyO7AqY3UkWcT:+mRDiHPBeZBOc
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1