Overview

overview

10

Static

static

8

SecuriteIn...88.exe

windows7_x64

10

SecuriteIn...88.exe

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-12-2021 22:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.26274.17388.exe

  • Size

    5.9MB

  • MD5

    24d7b3e065cb0570a44a101641acd8b4

  • SHA1

    7f71838113850cf07bebfe1da7a9211a7119a579

  • SHA256

    75d85fc34ed91e2de083d9342c41e2966bce7beab75732e3e1316ee62e550e9c

  • SHA512

    a7b9258d1e65f95461bbbb70169d29697c33e9ef348f850a76d866d9163f6e657275267a7b11f0a4032b3471d47095c471b0a22a7b9aacb432e912138cc40bbf

Score
10/10
redline444infostealerspywarevmprotect

Malware Config

Extracted

Family

redline

Botnet

444

C2

31.131.254.105:1498

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.26274.17388.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.26274.17388.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1632-53-0x00000000000F0000-0x00000000000F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-54-0x00000000000F0000-0x00000000000F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-55-0x00000000000F0000-0x00000000000F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-56-0x0000000000100000-0x0000000000101000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-57-0x0000000000100000-0x0000000000101000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-58-0x0000000000100000-0x0000000000101000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-60-0x0000000000110000-0x0000000000111000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-61-0x0000000000110000-0x0000000000111000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-63-0x0000000000120000-0x0000000000121000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-64-0x0000000000120000-0x0000000000121000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-66-0x0000000000130000-0x0000000000131000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-67-0x0000000000130000-0x0000000000131000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-69-0x0000000000140000-0x0000000000141000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-70-0x0000000000140000-0x0000000000141000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-71-0x0000000000150000-0x0000000000151000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-72-0x0000000000150000-0x0000000000151000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-74-0x0000000000160000-0x0000000000161000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-75-0x0000000000160000-0x0000000000161000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-76-0x0000000000160000-0x0000000000161000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1632-77-0x0000000000240000-0x0000000000CF1000-memory.dmp
    Filesize

    10.7MB

    Download
  • memory/1632-78-0x0000000000150000-0x0000000000151000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1724-82-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1724-81-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1724-87-0x0000000000419322-mapping.dmp
    Download
  • memory/1724-89-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1724-88-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1724-90-0x0000000000400000-0x0000000000401000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1724-92-0x00000000011A0000-0x00000000011A1000-memory.dmp
    Filesize

    4KB

    Download