Analysis
-
max time kernel
78s -
max time network
81s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-12-2020 01:46
General
-
Target
SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe
-
Size
512KB
-
MD5
3f4e559cf4c7ce058a3c1368f5137840
-
SHA1
d079140a01cb3ac2eb5421cf05d2c60472331c96
-
SHA256
b9ff9371b8d7b58efd56d5d5b7e63b71db6053be98c3b072e8743fd664c6b29b
-
SHA512
c1fe67d5457221bc88e4d01459107123c62c0237b4b8fe4f11a0a2500bffe98055ad13322163ccf0be8e4046b427f224a4a75a24a0ed488e2be201aed80ac151
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.241879.18500.7579.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4a30a8132195c1aa1a62b78676b178d9
SHA1506e6d99a2ba08c9d3553af30daaaa0fc46ae4be
SHA25671636c227625058652c089035480b7bb3e5795f3998bc9823c401029fc844a20
SHA5123272b5129525c2b8f7efb99f5a2115cf2572480ff6938ca80e63f02c52588216f861307b9ef962ba015787cae0d5a95e74ebb5fe4b35b34f1c4f3a7deac8ce09
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
612KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
152KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
612KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
4KB
-
-