Analysis
- max time kernel
122s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
25/10/2021, 12:19
General
- Target SecuriteInfo.com.W32.AIDetect.malware1.28092.28020.exe
- Size 297KB
- Sample211025-pg7lpahabp
- SHA256 a5211b70fe507dc2c7d8e3eb0b6796ceb5a8ad48e801d9ea2e55f4b31bfd7f16
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.28092.28020.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.28092.28020.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3912-116-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/3912-117-0x0000000000400000-0x000000000057E000-memory.dmp
memory/3912-118-0x00000000024E0000-0x00000000024FC000-memory.dmp
memory/3912-119-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/3912-121-0x0000000004D62000-0x0000000004D63000-memory.dmp
memory/3912-120-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/3912-122-0x0000000004D63000-0x0000000004D64000-memory.dmp
memory/3912-123-0x0000000002790000-0x00000000027AB000-memory.dmp
memory/3912-124-0x0000000005270000-0x0000000005271000-memory.dmp
memory/3912-125-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/3912-126-0x0000000005880000-0x0000000005881000-memory.dmp
memory/3912-127-0x0000000004D64000-0x0000000004D66000-memory.dmp
memory/3912-128-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/3912-129-0x0000000005990000-0x0000000005991000-memory.dmp
memory/3912-130-0x0000000005B00000-0x0000000005B01000-memory.dmp
memory/3912-131-0x0000000006310000-0x0000000006311000-memory.dmp
memory/3912-132-0x0000000006390000-0x0000000006391000-memory.dmp
memory/3912-133-0x0000000006570000-0x0000000006571000-memory.dmp
memory/3912-134-0x0000000006750000-0x0000000006751000-memory.dmp
memory/3912-135-0x0000000006920000-0x0000000006921000-memory.dmp