Overview

overview

10

Static

static

3

caad395aef...b4.exe

windows7-x64

10

caad395aef...b4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4.exe

  • Size

    3.2MB

  • Sample

    240725-gqf64asdkl

  • MD5

    b49ab1057d8a84fcfab28e98cfbf7330

  • SHA1

    b5740a5eeef81280e7b7c9556487d3d5e21725f0

  • SHA256

    caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4

  • SHA512

    d2ba08fee9f409d9b994fa66ac2db1b28f87590ced2461bde6f776bb0289fc2dbdea1ff725bdfca12dd4caadfc15560b2dc5a5fb60578dbe517e60de7d2d6149

  • SSDEEP

    98304:+9ckJgZJBx32c8a3TiHPBeZRuyO7AqY3UkWcT:+mRDiHPBeZBOc

Score
10/10
dcratredlinesectopratmadaspackv2discoveryinfostealerpersistencerattrojan

Malware Config

Extracted

Family

redline

Botnet

MAD

C2

185.189.14.66:4090

Targets

    • Target

      caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4.exe

    • Size

      3.2MB

    • MD5

      b49ab1057d8a84fcfab28e98cfbf7330

    • SHA1

      b5740a5eeef81280e7b7c9556487d3d5e21725f0

    • SHA256

      caad395aeff17ecc47ae5b0989cc8c1338af1c6cd405af7af8cb3e9533be0ab4

    • SHA512

      d2ba08fee9f409d9b994fa66ac2db1b28f87590ced2461bde6f776bb0289fc2dbdea1ff725bdfca12dd4caadfc15560b2dc5a5fb60578dbe517e60de7d2d6149

    • SSDEEP

      98304:+9ckJgZJBx32c8a3TiHPBeZRuyO7AqY3UkWcT:+mRDiHPBeZBOc

    Score
    10/10
    dcratredlinesectopratmadaspackv2discoveryinfostealerpersistencerattrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks