Overview

overview

10

Static

static

SecuriteIn...79.exe

windows7_x64

10

SecuriteIn...79.exe

windows10_x64

10

Analysis

  • max time kernel
    27s
  • max time network
    24s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01-12-2020 01:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe

  • Size

    512KB

  • MD5

    3f4e559cf4c7ce058a3c1368f5137840

  • SHA1

    d079140a01cb3ac2eb5421cf05d2c60472331c96

  • SHA256

    b9ff9371b8d7b58efd56d5d5b7e63b71db6053be98c3b072e8743fd664c6b29b

  • SHA512

    c1fe67d5457221bc88e4d01459107123c62c0237b4b8fe4f11a0a2500bffe98055ad13322163ccf0be8e4046b427f224a4a75a24a0ed488e2be201aed80ac151

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"
        3⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:328
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • Runs ping.exe
          PID:1560

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/328-15-0x0000000000000000-mapping.dmp

    Download

  • memory/848-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/848-3-0x0000000000A30000-0x0000000000A31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/848-5-0x0000000000540000-0x000000000056C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/848-6-0x00000000007D0000-0x0000000000817000-memory.dmp

    Filesize

    284KB

    Download

  • memory/848-7-0x00000000005D0000-0x00000000005E6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1352-8-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1352-9-0x0000000000420D82-mapping.dmp

    Download

  • memory/1352-10-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1352-11-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1352-12-0x00000000748D0000-0x0000000074FBE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1560-16-0x0000000000000000-mapping.dmp

    Download