Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-03-2021 14:48
General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen2.61780.11290.1252.exe
-
Size
957KB
-
MD5
c9160a76ce50e71aac16e13adc88b002
-
SHA1
90a0dbf0d1455e1d50c2f9a7f43bddad4e2b28c3
-
SHA256
9fd72df8cc980ea1257a11c3e64acb9b004caa7670dbe36f021615ce636b567a
-
SHA512
6d9f3d5e13c5e08e5a1b38fb08f1dee630421dbd52269704ff3149c75f0811d90aa88ab6a78a215389fef64ac7c26a05bd262a12b3fb2a2cd8f8cdc4dee5c4bb
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
themida 4 IoCs
Detects Themida, Advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.61780.11290.1252.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.61780.11290.1252.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.61780.11290.1252.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.61780.11290.1252.exe"2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\revs.exe"C:\Users\Admin\AppData\Local\Temp\revs.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
61a03d15cf62612f50b74867090dbe79
SHA115228f34067b4b107e917bebaf17cc7c3c1280a8
SHA256f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d
SHA5125fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
12f238b64d648218ac028db1b8f78ec5
SHA1d673ea801ef731da265e2f4132415538bddd1f1c
SHA2567a7a2ac800e2a7f0f695e54d60442f22a9473c6acbfc24e7bdb3ee8efd50fd35
SHA5122314be1638493e7f4fabf0c9f383df4cfd45d77bc1290fa0f714cb572803bf7b6fed9a814a4c274e492f98ebd7bca3c6977cb20a2a030599af62b36277eef725
-
C:\Users\Admin\AppData\Local\Temp\revs.exeMD5
ee33281115a2970d784ab9731615fe31
SHA1479d590f848f12ceca4e1170a0e0ce2e141f3cb8
SHA256c56e6f80aa285705c1dc07d4dfa0183d525a39d5540dea942398899daa289b73
SHA512e4695cb6abc5b9de4837a9100775dfb03bcdb4be3d838074d2f40f32a19416d17bc8688ecb82ddc1f95bc0cc29248ab8d100a7be24f58cadea1327addd101557
-
C:\Users\Admin\AppData\Local\Temp\revs.exeMD5
ee33281115a2970d784ab9731615fe31
SHA1479d590f848f12ceca4e1170a0e0ce2e141f3cb8
SHA256c56e6f80aa285705c1dc07d4dfa0183d525a39d5540dea942398899daa289b73
SHA512e4695cb6abc5b9de4837a9100775dfb03bcdb4be3d838074d2f40f32a19416d17bc8688ecb82ddc1f95bc0cc29248ab8d100a7be24f58cadea1327addd101557
-
\Users\Admin\AppData\Local\Temp\revs.exeMD5
ee33281115a2970d784ab9731615fe31
SHA1479d590f848f12ceca4e1170a0e0ce2e141f3cb8
SHA256c56e6f80aa285705c1dc07d4dfa0183d525a39d5540dea942398899daa289b73
SHA512e4695cb6abc5b9de4837a9100775dfb03bcdb4be3d838074d2f40f32a19416d17bc8688ecb82ddc1f95bc0cc29248ab8d100a7be24f58cadea1327addd101557
-
memory/1660-15-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/1660-10-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1660-11-0x000000000041FA46-mapping.dmp
-
memory/1660-12-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1660-13-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1872-9-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/1872-2-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1872-8-0x00000000006F0000-0x00000000006FB000-memory.dmpFilesize
44KB
-
memory/1872-7-0x0000000001F10000-0x0000000001F3F000-memory.dmpFilesize
188KB
-
memory/1872-5-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/1872-3-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1984-17-0x0000000000000000-mapping.dmp
-
memory/1984-19-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/1984-21-0x0000000074350000-0x0000000074A3E000-memory.dmpFilesize
6.9MB
-
memory/1984-22-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/1984-24-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB