Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-02-2021 14:16
General
-
Target
SecuriteInfo.com.Mal.Generic-S.4760.31355.exe
-
Size
617KB
-
MD5
b12a60ebc3ea1cdfd45135718cbd8d10
-
SHA1
3a4172d1af8d4de5e851a5e062ea7ecd465359eb
-
SHA256
641bb3150de61700fad862e127e9cf6cc2c5b11e166dacf2722a9829bb92afd7
-
SHA512
10a9d39276c6b0fc28d900292a0c5d64edfe8154a9f516627006c1ee51a14ffd230f30bfb19485dfe27fc6532874b00e248711308bb7ffd56e74b992e123b7ef
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.4760.31355.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.4760.31355.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Mal.Generic-S.4760.31355.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Mal.Generic-S.4760.31355.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/3136-20-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/3136-19-0x0000000002F30000-0x0000000002F31000-memory.dmpFilesize
4KB
-
memory/3136-12-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3136-24-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/3136-13-0x000000000041EFDE-mapping.dmp
-
memory/3136-22-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/3136-21-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/3136-15-0x0000000073430000-0x0000000073B1E000-memory.dmpFilesize
6.9MB
-
memory/3136-25-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/3136-23-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/3136-18-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/4692-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/4692-11-0x0000000008D70000-0x0000000008DE2000-memory.dmpFilesize
456KB
-
memory/4692-5-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/4692-2-0x0000000073430000-0x0000000073B1E000-memory.dmpFilesize
6.9MB
-
memory/4692-10-0x0000000005830000-0x000000000583B000-memory.dmpFilesize
44KB
-
memory/4692-9-0x0000000008E10000-0x0000000008E11000-memory.dmpFilesize
4KB
-
memory/4692-8-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/4692-7-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/4692-6-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB