Extracted

• • Target
    6b4d77b782e96c4ab27051e2c86457ee12c2f4921c0ca5ee44631b47eebece6c.exe
  • Size 45.0MB
  • SHA256 6b4d77b782e96c4ab27051e2c86457ee12c2f4921c0ca5ee44631b47eebece6c
  • MD5 4bcdb368dbb9230a42c0f799077ee2c2
  • SHA1 c8c66abc8fd5f5285254d757e240fa02312297c9
  • SHA512 94b071e5a722a2e441b73b4a11cbeaf2f22aced850a5e0d1d808eadd129e119e15d8ac4953d227a70c3158b957e83bae20a02c001fe9584ab3ec727f12544451
  • SSDEEP 786432:3YN8SjLc1JWQ30Jh/a077MESyWJQHbY4EaFPip14ZLl8ZrtiTW+Ji0qtPtQdD:g8j1kQ3GRkE8O00Pi14ZLlUr330qtVQt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinexmrig1defense_evasiondiscoveryexecutionexploitinfostealerminerpyinstaller

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • XMRig Miner payload

    miner

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2