Analysis
-
max time kernel
30s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-03-2021 07:54
Static task
static1
Behavioral task
behavioral1
Sample
0b781d805d90743544803c2159e368f7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0b781d805d90743544803c2159e368f7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
0b781d805d90743544803c2159e368f7.exe
-
Size
26KB
-
MD5
0b781d805d90743544803c2159e368f7
-
SHA1
bdd041b20f5e1a839081ea89ba5a7fe110d7a26b
-
SHA256
a77694d524cba3de7f828ee3c2a19308a6da5fafdb4c3320c083e2f681e9832d
-
SHA512
31db82e9a47b64a8a8ca23787cfd39bca83d1cb6addb095752a17755d6a855dadafc7c45be55c962c9677d56aa60473d97a6bdf4164209f1c0e6b40e18d3c4bb
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0b781d805d90743544803c2159e368f7.exedescription pid process target process PID 416 set thread context of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AddInProcess32.exepid process 3708 AddInProcess32.exe 3708 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0b781d805d90743544803c2159e368f7.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 416 0b781d805d90743544803c2159e368f7.exe Token: SeDebugPrivilege 3708 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0b781d805d90743544803c2159e368f7.exedescription pid process target process PID 416 wrote to memory of 2832 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 2832 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 2832 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe PID 416 wrote to memory of 3708 416 0b781d805d90743544803c2159e368f7.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b781d805d90743544803c2159e368f7.exe"C:\Users\Admin\AppData\Local\Temp\0b781d805d90743544803c2159e368f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵PID:2832
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708