Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-12-2020 17:04
General
-
Target
53c599ee6324db60c4b394722d950d3a.exe
-
Size
594KB
-
MD5
53c599ee6324db60c4b394722d950d3a
-
SHA1
7a5d027376db62faecbe44d866a908f3915fc4f1
-
SHA256
0d828c5af228839b87308f801d19ce5ea0ffc333eee641390c089207f16a96bf
-
SHA512
b0c24a3a70d3bfa22164e711fe2357f0f7241f46502e2cfc660d7e2b2a76a4ad571f0044c44a1a547fe08b3432575e3eab286ec14cd699f3cac9ef5f1d7f8f9f
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c599ee6324db60c4b394722d950d3a.exe"C:\Users\Admin\AppData\Local\Temp\53c599ee6324db60c4b394722d950d3a.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\leadentop\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB