Analysis
-
max time kernel
61s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-03-2021 09:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
-
Size
205KB
-
MD5
ecd8ffbea7663996b2d7298bb3088e6a
-
SHA1
0f57aa1bbdca911955036057ea54ccc3a4eb45e2
-
SHA256
541eea3db458d43683da16a81d5d9edc6c0b020008a5a3314ba624a4339917a3
-
SHA512
a9de3f8adca174dd9f1322c8236c0d0ce601335cb61c6be06a61c7c66ef7cc5a6ddfb0bedcf1c00520a1b45ec3c6e21c7d55b4a5a2b3dbb277dcaaa386c20d9d
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4716-4-0x0000000002340000-0x0000000002369000-memory.dmp family_redline behavioral2/memory/4716-6-0x0000000004E50000-0x0000000004E77000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exepid process 4716 SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe 4716 SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exedescription pid process Token: SeDebugPrivilege 4716 SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4716-2-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/4716-3-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/4716-4-0x0000000002340000-0x0000000002369000-memory.dmpFilesize
164KB
-
memory/4716-5-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/4716-6-0x0000000004E50000-0x0000000004E77000-memory.dmpFilesize
156KB
-
memory/4716-7-0x00000000023D0000-0x00000000023D1000-memory.dmpFilesize
4KB
-
memory/4716-8-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/4716-9-0x00000000023D2000-0x00000000023D3000-memory.dmpFilesize
4KB
-
memory/4716-10-0x00000000023D3000-0x00000000023D4000-memory.dmpFilesize
4KB
-
memory/4716-11-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/4716-12-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/4716-13-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/4716-14-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/4716-15-0x00000000023D4000-0x00000000023D6000-memory.dmpFilesize
8KB
-
memory/4716-16-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/4716-17-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/4716-18-0x0000000006520000-0x0000000006521000-memory.dmpFilesize
4KB
-
memory/4716-19-0x0000000006710000-0x0000000006711000-memory.dmpFilesize
4KB
-
memory/4716-20-0x0000000006D50000-0x0000000006D51000-memory.dmpFilesize
4KB
-
memory/4716-21-0x0000000006E00000-0x0000000006E01000-memory.dmpFilesize
4KB
-
memory/4716-22-0x0000000007B00000-0x0000000007B01000-memory.dmpFilesize
4KB
-
memory/4716-23-0x0000000007EB0000-0x0000000007EB1000-memory.dmpFilesize
4KB