ScreenShot
| Created | 2023.10.23 09:42 | Machine | s1_win7_x6403 |
| Filename | fra.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | 48 detected (GenericKD, Artemis, RedLineStealer, malicious, confidence, 100%, high confidence, GenKryptik, GPHV, score, RedLineNET, kcnpua, PWSX, FalseSign, Ckjl, Kryptik, kavzo, PRIVATELOADER, YXDJVZ, high, Static AI, Malicious PE, ABRisk, XDIY, ai score=86, RedLine, 11AU12L, Detected, R615526, unsafe, Generic@AI, RDML, 6JhaQgGOXqUBKf1N2Vt9JQ, MalwThreat, 0190FT) | ||
| md5 | ba3cc252387fd4f90201c371bd3e0190 | ||
| sha256 | 6b96f6652af99c513bbe89a4c5e61e2729aa1f67ce0c0c3d0ca28d2959dcd82c | ||
| ssdeep | 12288:U8JU2lI99zBaruMczCFTBF4s4l+eXmzFvH1L:1lI99IruMczCFTBP4YznL | ||
| imphash | d350427820086a321ccf21b695161218 | ||
| impfuzzy | 24:WjKNDoVTg3kNdZ+fcslvMZt/OovRB7kJ3CFQHRyvuT4UjMZvZA5lICEC:gdZ+fceMZt2QZcOucBZufEC | ||
Network IP location
Signature (15cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 48 AntiVirus engines on VirusTotal as malicious |
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries for potentially installed applications |
| notice | Steals private information from local Internet browsers |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC Activity - MSValue (Outbound)
ET MALWARE Redline Stealer TCP CnC Activity - MSValue (Response)
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC Activity - MSValue (Outbound)
ET MALWARE Redline Stealer TCP CnC Activity - MSValue (Response)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 GlobalFindAtomA
0x41f028 FreeConsole
0x41f02c InterlockedIncrement
0x41f030 InterlockedDecrement
0x41f034 WideCharToMultiByte
0x41f038 InterlockedExchange
0x41f03c InitializeCriticalSection
0x41f040 DeleteCriticalSection
0x41f044 EnterCriticalSection
0x41f048 LeaveCriticalSection
0x41f04c MultiByteToWideChar
0x41f050 GetLastError
0x41f054 HeapFree
0x41f058 HeapAlloc
0x41f05c RtlUnwind
0x41f060 RaiseException
0x41f064 TerminateProcess
0x41f068 GetCurrentProcess
0x41f06c UnhandledExceptionFilter
0x41f070 SetUnhandledExceptionFilter
0x41f074 IsDebuggerPresent
0x41f078 GetCommandLineA
0x41f07c GetCPInfo
0x41f080 LCMapStringA
0x41f084 LCMapStringW
0x41f088 HeapCreate
0x41f08c VirtualFree
0x41f090 HeapReAlloc
0x41f094 GetModuleHandleW
0x41f098 ExitProcess
0x41f09c WriteFile
0x41f0a0 GetStdHandle
0x41f0a4 GetModuleFileNameA
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetSystemTimeAsFileTime
0x41f0ec GetConsoleCP
0x41f0f0 GetConsoleMode
0x41f0f4 FlushFileBuffers
0x41f0f8 ReadFile
0x41f0fc SetFilePointer
0x41f100 CloseHandle
0x41f104 HeapSize
0x41f108 GetACP
0x41f10c GetOEMCP
0x41f110 IsValidCodePage
0x41f114 GetUserDefaultLCID
0x41f118 GetLocaleInfoA
0x41f11c EnumSystemLocalesA
0x41f120 IsValidLocale
0x41f124 GetStringTypeA
0x41f128 GetStringTypeW
0x41f12c InitializeCriticalSectionAndSpinCount
0x41f130 WriteConsoleA
0x41f134 GetConsoleOutputCP
0x41f138 WriteConsoleW
0x41f13c SetStdHandle
0x41f140 GetLocaleInfoW
0x41f144 CreateFileA
USER32.dll
0x41f14c GetWindowTextLengthW
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 GlobalFindAtomA
0x41f028 FreeConsole
0x41f02c InterlockedIncrement
0x41f030 InterlockedDecrement
0x41f034 WideCharToMultiByte
0x41f038 InterlockedExchange
0x41f03c InitializeCriticalSection
0x41f040 DeleteCriticalSection
0x41f044 EnterCriticalSection
0x41f048 LeaveCriticalSection
0x41f04c MultiByteToWideChar
0x41f050 GetLastError
0x41f054 HeapFree
0x41f058 HeapAlloc
0x41f05c RtlUnwind
0x41f060 RaiseException
0x41f064 TerminateProcess
0x41f068 GetCurrentProcess
0x41f06c UnhandledExceptionFilter
0x41f070 SetUnhandledExceptionFilter
0x41f074 IsDebuggerPresent
0x41f078 GetCommandLineA
0x41f07c GetCPInfo
0x41f080 LCMapStringA
0x41f084 LCMapStringW
0x41f088 HeapCreate
0x41f08c VirtualFree
0x41f090 HeapReAlloc
0x41f094 GetModuleHandleW
0x41f098 ExitProcess
0x41f09c WriteFile
0x41f0a0 GetStdHandle
0x41f0a4 GetModuleFileNameA
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetSystemTimeAsFileTime
0x41f0ec GetConsoleCP
0x41f0f0 GetConsoleMode
0x41f0f4 FlushFileBuffers
0x41f0f8 ReadFile
0x41f0fc SetFilePointer
0x41f100 CloseHandle
0x41f104 HeapSize
0x41f108 GetACP
0x41f10c GetOEMCP
0x41f110 IsValidCodePage
0x41f114 GetUserDefaultLCID
0x41f118 GetLocaleInfoA
0x41f11c EnumSystemLocalesA
0x41f120 IsValidLocale
0x41f124 GetStringTypeA
0x41f128 GetStringTypeW
0x41f12c InitializeCriticalSectionAndSpinCount
0x41f130 WriteConsoleA
0x41f134 GetConsoleOutputCP
0x41f138 WriteConsoleW
0x41f13c SetStdHandle
0x41f140 GetLocaleInfoW
0x41f144 CreateFileA
USER32.dll
0x41f14c GetWindowTextLengthW
EAT(Export Address Table) is none