General
-
Target
1bbc3bff13812c25d47cd84bca3da2dc.exe
-
Size
300KB
-
Sample
241213-axw3kavken
-
MD5
1bbc3bff13812c25d47cd84bca3da2dc
-
SHA1
d3406bf8d0e9ac246c272fa284a35a3560bdbff5
-
SHA256
0a17e2ca8f223de67c0864fac1d24c7bb2d0c796c46e9ce04e4dff374c577ea1
-
SHA512
181b1e2bd08978b6ee3da2b48e0b113623b85c42ab8cec2a23bd5119aba7105fdeef9b7b00343d37b0c8344494640ce0a51615393def8242334420134f75871f
-
SSDEEP
6144:O2JKCwoXjMvjfTK/zNTdEpZ4m1qpxXQKQrUJ0tYRVAOTIdTsImm:8CwoXjMbTKLNhEpZ4m0vXQKQrxgu
Static task
static1
Behavioral task
behavioral1
Sample
1bbc3bff13812c25d47cd84bca3da2dc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1bbc3bff13812c25d47cd84bca3da2dc.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
eewx
185.81.68.147:1912
Extracted
amadey
5.10
0f3be6
http://185.81.68.147
http://185.81.68.148
-
install_dir
ee29ea508b
-
install_file
Gxtuum.exe
-
strings_key
d3a5912ea69ad34a2387af70c8be9e21
-
url_paths
/7vhfjke3/index.php
/8Fvu5jh4DbS/index.php
Targets
-
-
Target
1bbc3bff13812c25d47cd84bca3da2dc.exe
-
Size
300KB
-
MD5
1bbc3bff13812c25d47cd84bca3da2dc
-
SHA1
d3406bf8d0e9ac246c272fa284a35a3560bdbff5
-
SHA256
0a17e2ca8f223de67c0864fac1d24c7bb2d0c796c46e9ce04e4dff374c577ea1
-
SHA512
181b1e2bd08978b6ee3da2b48e0b113623b85c42ab8cec2a23bd5119aba7105fdeef9b7b00343d37b0c8344494640ce0a51615393def8242334420134f75871f
-
SSDEEP
6144:O2JKCwoXjMvjfTK/zNTdEpZ4m1qpxXQKQrUJ0tYRVAOTIdTsImm:8CwoXjMbTKLNhEpZ4m0vXQKQrxgu
-
Amadey family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1