Analysis
-
max time kernel
44s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 17:53
General
-
Target
291fb9999009b5cb5e1ce39a6c58472291cdaaaeeea56beb6a4d0b7925574dca.exe
-
Size
2.6MB
-
MD5
7d5efe07472bd441a9d6b3eefc33008f
-
SHA1
bd2d32b6b2145489eb7cf1371315bf97661e7f86
-
SHA256
291fb9999009b5cb5e1ce39a6c58472291cdaaaeeea56beb6a4d0b7925574dca
-
SHA512
49e87152870ddecfc8695fce4d6c81d0bab0889be26c85a3b14b0abf1f60cb848f63c244fde55266c72d58ac1a2c7e38e633b828e8177dc64fbda2c8e003c7bb
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
themida 1 IoCs
Detects Themida, Advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\291fb9999009b5cb5e1ce39a6c58472291cdaaaeeea56beb6a4d0b7925574dca.exe"C:\Users\Admin\AppData\Local\Temp\291fb9999009b5cb5e1ce39a6c58472291cdaaaeeea56beb6a4d0b7925574dca.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB