General
-
Target
e7e514f3fb155d14eef5f4fda3f5bc483a82678a810683d931aeaad2c48326fb
-
Size
1.3MB
-
Sample
240726-e9ca5szemd
-
MD5
6ec598a97b7861dea2a420586b1e20ce
-
SHA1
535dc45cdf26464113276207742cf34e9fd6690d
-
SHA256
e7e514f3fb155d14eef5f4fda3f5bc483a82678a810683d931aeaad2c48326fb
-
SHA512
39b27ad7baa93763c689083d40f4582a0d1c7443b4e2eccb303237736ee334b0d8af938bd87e423cf77bfe58232ce053d3e8b264f0290f9d55db2ec823d0ebaf
-
SSDEEP
24576:U3Tn8To77OBhyF9E1sfygwl/vnpCO4npTnqTb18vMaT/u2wlhAaJxDK2:U3T1CBhgE7gwJnpCO+dneuvl/uFxd
Static task
static1
Behavioral task
behavioral1
Sample
07f970cff95e1ebcde588ad8808915376341e9f371f9c05a9873f942988b4ac8.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
07f970cff95e1ebcde588ad8808915376341e9f371f9c05a9873f942988b4ac8.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
07f970cff95e1ebcde588ad8808915376341e9f371f9c05a9873f942988b4ac8.exe
-
Size
1.8MB
-
MD5
d7e66880341b1a0e1bd53696b64e4833
-
SHA1
1609e5620c3a8151adc69ba3b058538597d77aa6
-
SHA256
07f970cff95e1ebcde588ad8808915376341e9f371f9c05a9873f942988b4ac8
-
SHA512
67b34ef9fa7a1ade39b56250dba47853f4a900294dca053ade07f4f59168c520d127ca8809eb2356767444d323424da449493f57946f84ae1d1c9bdb1c20e64f
-
SSDEEP
49152:nTvC/MTQYxsWR7aqXHHJpGPn8z+uPQVpSfyYEpq:TjTQYxsWRRnTGP86pA9Ep
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1