Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-02-2021 14:16
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe
-
Size
617KB
-
MD5
c26cc90827555cd37a7a5c1088c0261a
-
SHA1
571908a143295bba4d75b57e953f4f18e3bc74cd
-
SHA256
e1ccbcfb77a8ee31db04f21a4962ed0c117bb65a3ce3e453a6176068a379e011
-
SHA512
c4387351b42835f43dd04518da2744b9b5848a40ca18cc8d6b7b633c9460e98d21cbe7ce86005cb3813bbeaa886b6f300fdca65a50c5e1841fde3fa6f937009f
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/672-8-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral1/memory/672-9-0x000000000041EFE2-mapping.dmp family_redline behavioral1/memory/672-11-0x0000000000400000-0x0000000000426000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exedescription pid process target process PID 1856 set thread context of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exedescription pid process Token: SeDebugPrivilege 672 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exedescription pid process target process PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe PID 1856 wrote to memory of 672 1856 SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.PWS-FCUFC26CC9082755.32639.28315.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-8-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/672-9-0x000000000041EFE2-mapping.dmp
-
memory/672-10-0x0000000074590000-0x0000000074C7E000-memory.dmpFilesize
6.9MB
-
memory/672-11-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/672-13-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/1856-2-0x0000000074590000-0x0000000074C7E000-memory.dmpFilesize
6.9MB
-
memory/1856-3-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/1856-5-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/1856-6-0x0000000000560000-0x000000000056B000-memory.dmpFilesize
44KB
-
memory/1856-7-0x0000000007ED0000-0x0000000007F3D000-memory.dmpFilesize
436KB