General
-
Target
file.exe
-
Size
1.8MB
-
Sample
240823-2l3vhstbkk
-
MD5
8ccccf60e1da1297be1625dc58cdcdff
-
SHA1
09d0442cb40ec9f4bc4d727c29d7c03cc70737b3
-
SHA256
81817190fd64f27e2915a21ca64b4b04846165cbc9f0351a6281472010331192
-
SHA512
01d4dbf8ee13481fc0a4ad32aa0610a041584ec7b663d43b9fad0ae919d9a2048892bc346f10e445337f5d431f3e7b98d7742c823b12e4b21cff032070d745dd
-
SSDEEP
49152:L3uBahDZZ61NvPIIbr4BIqa3W+Hs9qkkssT80o3DT:L3ucq1NvPB7b7bTz
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.163.21:29257
Extracted
redline
@CLOUDYTTEAM
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
redline
14082024
185.215.113.67:21405
Extracted
redline
816FA
88.99.151.68:7200
Extracted
xworm
154.216.18.213:7000
-
install_file
USB.exe
Extracted
lumma
https://potentioallykeos.shop/api
https://deicedosmzj.shop/api
Extracted
redline
cheat
62.113.117.95:29928
Targets
-
-
Target
file.exe
-
Size
1.8MB
-
MD5
8ccccf60e1da1297be1625dc58cdcdff
-
SHA1
09d0442cb40ec9f4bc4d727c29d7c03cc70737b3
-
SHA256
81817190fd64f27e2915a21ca64b4b04846165cbc9f0351a6281472010331192
-
SHA512
01d4dbf8ee13481fc0a4ad32aa0610a041584ec7b663d43b9fad0ae919d9a2048892bc346f10e445337f5d431f3e7b98d7742c823b12e4b21cff032070d745dd
-
SSDEEP
49152:L3uBahDZZ61NvPIIbr4BIqa3W+Hs9qkkssT80o3DT:L3ucq1NvPB7b7bTz
-
Detect Xworm Payload
-
Detects Monster Stealer.
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
8System Information Discovery
10System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2