dddad0090e809330f750ddafeb648afe18b2167197c64350fd3b3b57917a7eeb

General

Target
red room.exe
Size 10.4MB
Sample261024-ylp2wady2p
SHA256 dddad0090e809330f750ddafeb648afe18b2167197c64350fd3b3b57917a7eeb
MD5 1cd6d9b5328cf5d3493b79a59ed1ba61
SHA1 60b6ee257e42e1edd3e54808854add916d3abebd
SHA512 ab7730fb42e772e063f254d7b4051f598372ad345ab5dc866027733e0af2b6e49f27765d163bb2968e87b2f9b9cf77d3cdb77565258b34e6849d8768e0350547
SSDEEP 196608:FdmB0W8/Lm1W903eV4QRItpDjIIAcwD/au5thoANNURPBvvk9UIL:/myW8gW+eGQRg9jo/au5thoA/UCt
TLSH
T116B63384B3C84DE4F8AA527E99C00907D6B2B47207B8C6C78BF559520E733C8EE7A755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  red room.exe
- Size 10.4MB
- SHA256 dddad0090e809330f750ddafeb648afe18b2167197c64350fd3b3b57917a7eeb
- MD5 1cd6d9b5328cf5d3493b79a59ed1ba61
- SHA1 60b6ee257e42e1edd3e54808854add916d3abebd
- SHA512 ab7730fb42e772e063f254d7b4051f598372ad345ab5dc866027733e0af2b6e49f27765d163bb2968e87b2f9b9cf77d3cdb77565258b34e6849d8768e0350547
- SSDEEP 196608:FdmB0W8/Lm1W903eV4QRItpDjIIAcwD/au5thoANNURPBvvk9UIL:/myW8gW+eGQRg9jo/au5thoA/UCt
- TLSH
  T116B63384B3C84DE4F8AA527E99C00907D6B2B47207B8C6C78BF559520E733C8EE7A755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution persistence privilege_escalation spyware stealer
- Modifies WinLogon for persistence
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2