Overview

overview

10

Static

static

CryptoMiner.exe

windows7_x64

10

CryptoMiner.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CryptoMiner.exe

  • Size

    1.5MB

  • Sample

    220505-bvntvahfap

  • MD5

    310eb5bd45ac9c5767d28e63ab64635b

  • SHA1

    4ac0d40abb71e9fcff34c8f67511fc590f495f3e

  • SHA256

    d1d622e31d20a69fc6fea0d98996607f37f6204bb02625bfb329cfdbb8edb6e6

  • SHA512

    c2b0c3e890bb92f527960230c97c9c75ce50a2b9c4186c1dea87f7e55892702ac82805e5a038b8d32614790357c3ad113afe63e7f77cc99866801f4fdbac5e97

Score
10/10
redline@watercloudrobot - oblako za 8500evasioninfostealerspywaretrojan

Malware Config

Extracted

Family

redline

Botnet

@watercloudrobot - oblako za 8500

C2

65.21.213.209:32936

Attributes
  • auth_value

    a14b52bba3a0ad35d4f66edae1132d42

Targets

    • Target

      CryptoMiner.exe

    • Size

      1.5MB

    • MD5

      310eb5bd45ac9c5767d28e63ab64635b

    • SHA1

      4ac0d40abb71e9fcff34c8f67511fc590f495f3e

    • SHA256

      d1d622e31d20a69fc6fea0d98996607f37f6204bb02625bfb329cfdbb8edb6e6

    • SHA512

      c2b0c3e890bb92f527960230c97c9c75ce50a2b9c4186c1dea87f7e55892702ac82805e5a038b8d32614790357c3ad113afe63e7f77cc99866801f4fdbac5e97

    Score
    10/10
    redline@watercloudrobot - oblako za 8500evasioninfostealerspywaretrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks