Overview

overview

10

Static

static

SecuriteIn...44.exe

windows7_x64

10

SecuriteIn...44.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-03-2021 20:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.36452518.2355.1244.exe

  • Size

    160KB

  • MD5

    4ed06835dd64287ea65dbd0f16d164f7

  • SHA1

    a9553e8e70e67f94c07d618c117f0f661d65dbec

  • SHA256

    1f296bceec7fc11b709d744bc6230b5997cfd5e210360d6f91542e2251c866a1

  • SHA512

    20d4436a56ad84ba7478ee82083cba28570f8db8fdeae48171ec5f846569f1e2af5cfed14fe40111368ee5e9ea462a2094b3d68b23bc2cf3beddb2999b505f0b

Score
10/10
redlineinfostealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36452518.2355.1244.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36452518.2355.1244.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      2⤵
        PID:196
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        2⤵
          PID:3308
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          2⤵
            PID:3260
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3608

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1908-2-0x0000000002430000-0x0000000002431000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-3-0x00000000738B0000-0x0000000073F9E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/1908-4-0x0000000002200000-0x000000000220D000-memory.dmp
          Filesize

          52KB

          Download
        • memory/1908-5-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-6-0x0000000004B00000-0x0000000004B01000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-7-0x00000000025B0000-0x00000000025BC000-memory.dmp
          Filesize

          48KB

          Download
        • memory/1908-8-0x0000000004940000-0x0000000004941000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-9-0x00000000049C0000-0x00000000049C1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-10-0x0000000004AF2000-0x0000000004AF3000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-11-0x0000000004AF3000-0x0000000004AF4000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1908-12-0x0000000004AF4000-0x0000000004AF6000-memory.dmp
          Filesize

          8KB

          Download
        • memory/3608-13-0x0000000000400000-0x0000000000426000-memory.dmp
          Filesize

          152KB

          Download
        • memory/3608-14-0x000000000041E19E-mapping.dmp
          Download
        • memory/3608-15-0x00000000738B0000-0x0000000073F9E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3608-19-0x00000000055C0000-0x00000000055C1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3608-21-0x00000000060E0000-0x00000000060E1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3608-22-0x0000000005B80000-0x0000000005B81000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3608-23-0x0000000005BE0000-0x0000000005BE1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3608-24-0x0000000005C20000-0x0000000005C21000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3608-25-0x0000000005E80000-0x0000000005E81000-memory.dmp
          Filesize

          4KB

          Download