General
- Target Install-Dummynation-GooglePlayGames.exe
- Size 40.6MB
- Sample261029-2vgzeafv51
- SHA256 6be540696b28db3205a7211e9bdc7bc3ccfcb6584e31b8e2e4ec35aec59a32f8
Malware Config
Targets
-
- Target Install-Dummynation-GooglePlayGames.exe
- Size 40.6MB
- SHA256 6be540696b28db3205a7211e9bdc7bc3ccfcb6584e31b8e2e4ec35aec59a32f8
Score10/10-
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Drops file in Drivers directory
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Creates new service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1