General
- Target Tool.zip
- Size 9.3MB
- Sample260716-t6f79ads61
- SHA256 66b28bfd0d3b0012f291627dad4bb74e650b54ae24a44906125527fad4d1ed62
Malware Config
Extracted
-
redline
-
telegramone
-
163.5.160.27:51523
Targets
-
- Target Tool.zip
- Size 9.3MB
- SHA256 66b28bfd0d3b0012f291627dad4bb74e650b54ae24a44906125527fad4d1ed62
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Tool/ConsoleApp1.deps.json
- Size 425B
- SHA256 3d84fbd3e54af577e140bf8a1d3ded55961051a9d29b637418afdbe101201a09
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Tool/ConsoleApp1.dll
- Size 6KB
- SHA256 bda7b191c57f03dac42b18bcca21edb0627854d3a81386a174d72737aa7186e8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Tool/ConsoleApp1.pdb
- Size 10KB
- SHA256 c61c404d81adbdc122709a0847b2aa77428e982b4122cc301311dbc2279d1f69
Score3/10 -
- Target Tool/ConsoleApp1.runtimeconfig.json
- Size 268B
- SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
Score3/10 -
- Target Tool/Mono.Cecil.Mdb.pdb
- Size 18KB
- SHA256 891251514aa16f94485263c52faba51bb5bb3495b9fad382c74f6c9da78718dd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Tool/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
Score1/10 -
- Target Tool/Mono.Cecil.Rocks.dll
- Size 27KB
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
Score1/10 -
- Target Tool/Mono.Cecil.Rocks.pdb
- Size 8KB
- SHA256 5fcf9491b8d73f1f90a83ee7bda9097043903ba18822f1f22eacf92338b0d619
Score3/10 -
- Target Tool/Tool.exe
- Size 2.5MB
- SHA256 f4894d1b685f8b6a53bfcbc23869c806258c0b7e7def3f4f946c2d6a7019dfad
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Executes dropped EXE
-
Stops running service(s)
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Tool/how to use.txt
- Size 501B
- SHA256 5fbb97a5c504975f0ffb6dc0b97538a63ee3dd552f4ee4bd1c99745135c447e9
Score1/10 -
- Target Tool/stub.dll
- Size 96KB
- SHA256 6824c2c92eb7cee929f9c6b91e75c8c1fc3bfe80495eba4fa27118d40ad82b2b
Score10/10-
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
RedLine payload
-
SectopRAT payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Tool/x64/Mono.Cecil.Mdb.pdb
- Size 18KB
- SHA256 891251514aa16f94485263c52faba51bb5bb3495b9fad382c74f6c9da78718dd
Score3/10 -
- Target Tool/x64/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Tool/x64/Mono.Cecil.Pdb.pdb
- Size 25KB
- SHA256 7c3a6b12ef0676d3dc80a4e2b790f3dec4d7fdaa182b2181c3f6ee283b118a9e
Score3/10 -
- Target Tool/x64/Mono.Cecil.Rocks.dll
- Size 27KB
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2