General
-
Target
08aee2a865528a1bb95f565c81f15666877bc470694a8c26100402b19495ae15
-
Size
1.8MB
-
Sample
240730-fl1t9svajj
-
MD5
f66bf79e1f14f6568eba43ca241d00f3
-
SHA1
be651f0d681635b84ffaa76fd3618f6545f817d1
-
SHA256
08aee2a865528a1bb95f565c81f15666877bc470694a8c26100402b19495ae15
-
SHA512
587faa7c17c4fb5eee3552138d610c585e9eebcdd6a353a3408fc0cc40ccfa8037f993dcdd7fa4f65a0ffe226069c4a5aee8023c241f9475ba6d9b4e373a25c8
-
SSDEEP
49152:WcRpxpRMjGQPAJr7GgseVGL7cbL5r0ETKnj4JDI6T:WcfxiWv5sK67q50wJ8U
Static task
static1
Behavioral task
behavioral1
Sample
08aee2a865528a1bb95f565c81f15666877bc470694a8c26100402b19495ae15.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
20.52.165.210:39030
Extracted
stealc
QLL2
http://85.28.47.70
-
url_path
/744f169d372be841.php
Extracted
redline
25072023
185.215.113.67:40960
Extracted
redline
Logs
185.215.113.9:9137
Extracted
stealc
valenciga
http://45.158.12.58
-
url_path
/e47233787df7c9a6.php
Targets
-
-
Target
08aee2a865528a1bb95f565c81f15666877bc470694a8c26100402b19495ae15
-
Size
1.8MB
-
MD5
f66bf79e1f14f6568eba43ca241d00f3
-
SHA1
be651f0d681635b84ffaa76fd3618f6545f817d1
-
SHA256
08aee2a865528a1bb95f565c81f15666877bc470694a8c26100402b19495ae15
-
SHA512
587faa7c17c4fb5eee3552138d610c585e9eebcdd6a353a3408fc0cc40ccfa8037f993dcdd7fa4f65a0ffe226069c4a5aee8023c241f9475ba6d9b4e373a25c8
-
SSDEEP
49152:WcRpxpRMjGQPAJr7GgseVGL7cbL5r0ETKnj4JDI6T:WcfxiWv5sK67q50wJ8U
-
Detects Monster Stealer.
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2