Analysis
-
max time kernel
18s -
max time network
19s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-03-2021 09:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
-
Size
205KB
-
MD5
ecd8ffbea7663996b2d7298bb3088e6a
-
SHA1
0f57aa1bbdca911955036057ea54ccc3a4eb45e2
-
SHA256
541eea3db458d43683da16a81d5d9edc6c0b020008a5a3314ba624a4339917a3
-
SHA512
a9de3f8adca174dd9f1322c8236c0d0ce601335cb61c6be06a61c7c66ef7cc5a6ddfb0bedcf1c00520a1b45ec3c6e21c7d55b4a5a2b3dbb277dcaaa386c20d9d
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-4-0x00000000005D0000-0x00000000005F9000-memory.dmp family_redline behavioral1/memory/1924-5-0x0000000002060000-0x0000000002087000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exepid process 1924 SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe 1924 SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exedescription pid process Token: SeDebugPrivilege 1924 SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1924-2-0x0000000001E30000-0x0000000001E41000-memory.dmpFilesize
68KB
-
memory/1924-3-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/1924-4-0x00000000005D0000-0x00000000005F9000-memory.dmpFilesize
164KB
-
memory/1924-5-0x0000000002060000-0x0000000002087000-memory.dmpFilesize
156KB
-
memory/1924-6-0x0000000004891000-0x0000000004892000-memory.dmpFilesize
4KB
-
memory/1924-7-0x0000000004892000-0x0000000004893000-memory.dmpFilesize
4KB
-
memory/1924-8-0x0000000004893000-0x0000000004894000-memory.dmpFilesize
4KB
-
memory/1924-9-0x0000000004894000-0x0000000004896000-memory.dmpFilesize
8KB