General
-
Target
ChromeSetup.exe
-
Size
8.0MB
-
Sample
240629-y8r5rayfjl
-
MD5
4641579bd234f353da345f009bf460ea
-
SHA1
5a0201eddda21cf7f6156495f99da66b4715cb01
-
SHA256
bc677d2df4c9acb50253987d5904b573c12e62661923a022194ae09e103e8144
-
SHA512
1b68e095ae7d578ee31e5d4d8a2978499d3c5164708a1d0cdd2fec9448e0542e4201738755ce82a6b5d890ad5cd79c40faf96502f182232d9aeab02e27d5c2ff
-
SSDEEP
196608:bWi1ZYP2rPma7ts+ndryl6xmrsUbX1YmbWxAnwvS:b7e2rua7tsedwrsUbX1YcWxAnw
Static task
static1
Behavioral task
behavioral1
Sample
ChromeSetup.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
ChromeSetup.exe
-
Size
8.0MB
-
MD5
4641579bd234f353da345f009bf460ea
-
SHA1
5a0201eddda21cf7f6156495f99da66b4715cb01
-
SHA256
bc677d2df4c9acb50253987d5904b573c12e62661923a022194ae09e103e8144
-
SHA512
1b68e095ae7d578ee31e5d4d8a2978499d3c5164708a1d0cdd2fec9448e0542e4201738755ce82a6b5d890ad5cd79c40faf96502f182232d9aeab02e27d5c2ff
-
SSDEEP
196608:bWi1ZYP2rPma7ts+ndryl6xmrsUbX1YmbWxAnwvS:b7e2rua7tsedwrsUbX1YcWxAnw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-