Overview

overview

10

Static

static

SecuriteIn...60.exe

windows7_x64

10

SecuriteIn...60.exe

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    10-03-2021 20:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware2.12561.1160.exe

  • Size

    160KB

  • MD5

    73f7fb41b4a9c097171da9a8681114fe

  • SHA1

    6989870e0507a23a45e7ec29f200c56a675a80c8

  • SHA256

    c7d5bfc61e4ad60f64bbe4ed6de1774968ad5b66cae98bd5f93f27eb4067d4be

  • SHA512

    43eec0d09b780fd6d669e0e55ab310bba5a56b58fa6c98b4bff0e7aa99f1778dea9adff180b9fb9a7271a4a5726cfa6212ef97d363d147affa20578f4f98daa0

Score
10/10
redlineinfostealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.12561.1160.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.12561.1160.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      2⤵
        PID:1548
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1560

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Install Root Certificate

    1
    T1130

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/548-2-0x0000000002130000-0x0000000002141000-memory.dmp
      Filesize

      68KB

      Download
    • memory/548-3-0x0000000074AD0000-0x00000000751BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/548-4-0x0000000000780000-0x000000000078D000-memory.dmp
      Filesize

      52KB

      Download
    • memory/548-5-0x0000000000840000-0x000000000084C000-memory.dmp
      Filesize

      48KB

      Download
    • memory/548-7-0x0000000004902000-0x0000000004903000-memory.dmp
      Filesize

      4KB

      Download
    • memory/548-6-0x0000000004901000-0x0000000004902000-memory.dmp
      Filesize

      4KB

      Download
    • memory/548-8-0x0000000004903000-0x0000000004904000-memory.dmp
      Filesize

      4KB

      Download
    • memory/548-9-0x0000000004904000-0x0000000004906000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1560-10-0x0000000000400000-0x0000000000426000-memory.dmp
      Filesize

      152KB

      Download
    • memory/1560-11-0x000000000041E196-mapping.dmp
      Download
    • memory/1560-12-0x0000000074AD0000-0x00000000751BE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1560-13-0x0000000000400000-0x0000000000426000-memory.dmp
      Filesize

      152KB

      Download
    • memory/1560-15-0x0000000004A20000-0x0000000004A21000-memory.dmp
      Filesize

      4KB

      Download