Analysis
-
max time kernel
39s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-03-2021 07:41
Static task
static1
Behavioral task
behavioral1
Sample
5990bc0ea66f7d93280aa056f70f8c69.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5990bc0ea66f7d93280aa056f70f8c69.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
5990bc0ea66f7d93280aa056f70f8c69.exe
-
Size
27KB
-
MD5
5990bc0ea66f7d93280aa056f70f8c69
-
SHA1
723bd1c2e99c9c4625d08971ea2fd7a3308cc5f2
-
SHA256
dac87834202c054525c35d38d12c32dd18ac8b9b45b5d11f340fae8f6a287414
-
SHA512
9f85b9fb72580c2d338933cecec9cdeacc9eebeae5deb2716084d3a2f7eba799d4e813b52027fba01eb329ed7933a7cb90ec7d1245ec26c99fca7ce6d5b1e051
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5990bc0ea66f7d93280aa056f70f8c69.exedescription pid process target process PID 3928 set thread context of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AddInProcess32.exepid process 3824 AddInProcess32.exe 3824 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5990bc0ea66f7d93280aa056f70f8c69.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 3928 5990bc0ea66f7d93280aa056f70f8c69.exe Token: SeDebugPrivilege 3824 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5990bc0ea66f7d93280aa056f70f8c69.exedescription pid process target process PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe PID 3928 wrote to memory of 3824 3928 5990bc0ea66f7d93280aa056f70f8c69.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5990bc0ea66f7d93280aa056f70f8c69.exe"C:\Users\Admin\AppData\Local\Temp\5990bc0ea66f7d93280aa056f70f8c69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824