General
-
Target
402696f665e6e69600bd8e7197172340N.exe
-
Size
640KB
-
Sample
240820-fctdtsxfnr
-
MD5
402696f665e6e69600bd8e7197172340
-
SHA1
f7cac6619db6976fb413903653c6965715b66822
-
SHA256
a9d453c717e8e5a9a97fc490fa534cfd9a7710a96167b651db362b960a8f422e
-
SHA512
8d5acde1897ed4ed0c45c9242233849499366e9e69b64a899120de510169ef2a1b198549a8454d398f456a51da3138eaf93140cdc8121c7d6eb14b3468da43d0
-
SSDEEP
12288:yoQyRAk2F72CUVggHS29/wHKsqEObgdm47LdZ2LJ8UEjgapjpFBYAzZy:fR2F7VuozH2i/tYLWUkz
Static task
static1
Behavioral task
behavioral1
Sample
402696f665e6e69600bd8e7197172340N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
402696f665e6e69600bd8e7197172340N.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
redline
success-logs
147.182.130.25:16383
Targets
-
-
Target
402696f665e6e69600bd8e7197172340N.exe
-
Size
640KB
-
MD5
402696f665e6e69600bd8e7197172340
-
SHA1
f7cac6619db6976fb413903653c6965715b66822
-
SHA256
a9d453c717e8e5a9a97fc490fa534cfd9a7710a96167b651db362b960a8f422e
-
SHA512
8d5acde1897ed4ed0c45c9242233849499366e9e69b64a899120de510169ef2a1b198549a8454d398f456a51da3138eaf93140cdc8121c7d6eb14b3468da43d0
-
SSDEEP
12288:yoQyRAk2F72CUVggHS29/wHKsqEObgdm47LdZ2LJ8UEjgapjpFBYAzZy:fR2F7VuozH2i/tYLWUkz
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2