Overview

overview

10

Static

static

SecuriteIn...49.exe

windows7_x64

10

SecuriteIn...49.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    06-02-2022 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.48274970.27549.exe

  • Size

    1.8MB

  • MD5

    8c7c8512e1de244c679575f825640f2b

  • SHA1

    f5164e0228e18a37de301eeedf6494bae72ddba5

  • SHA256

    e6496deacc785f638940cc3b3cef72bdb9ffea30624d992bbd35d29aacdcb7c2

  • SHA512

    4f1b4629c4fbcc5d795773cf3731f11a5f67af3416511c1baa38c66b3401af8bf21de33e7eb7ae01bad3c1d9777294258b91947f40267076cd8829d2ab9f68ad

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.48274970.27549.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.48274970.27549.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2020-53-0x0000000075CE1000-0x0000000075CE3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2020-54-0x0000000075110000-0x000000007515A000-memory.dmp
    Filesize

    296KB

    Download
  • memory/2020-55-0x0000000000280000-0x00000000002C6000-memory.dmp
    Filesize

    280KB

    Download
  • memory/2020-56-0x00000000003F0000-0x0000000000591000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2020-57-0x00000000000C0000-0x00000000000C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2020-59-0x00000000758B0000-0x000000007595C000-memory.dmp
    Filesize

    688KB

    Download
  • memory/2020-60-0x0000000076C30000-0x0000000076C77000-memory.dmp
    Filesize

    284KB

    Download
  • memory/2020-61-0x0000000075C70000-0x0000000075CC7000-memory.dmp
    Filesize

    348KB

    Download
  • memory/2020-63-0x0000000077270000-0x00000000773CC000-memory.dmp
    Filesize

    1.4MB

    Download
  • memory/2020-64-0x00000000003F0000-0x0000000000591000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2020-66-0x00000000000E0000-0x00000000000E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2020-65-0x0000000077500000-0x000000007758F000-memory.dmp
    Filesize

    572KB

    Download
  • memory/2020-67-0x0000000074750000-0x00000000747D0000-memory.dmp
    Filesize

    512KB

    Download
  • memory/2020-68-0x0000000075CE0000-0x000000007692A000-memory.dmp
    Filesize

    12.3MB

    Download
  • memory/2020-69-0x0000000002370000-0x0000000002371000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2020-70-0x0000000074290000-0x00000000742A7000-memory.dmp
    Filesize

    92KB

    Download
  • memory/2020-71-0x0000000076FB0000-0x0000000076FE5000-memory.dmp
    Filesize

    212KB

    Download
  • memory/2020-72-0x000000006C310000-0x000000006C4A0000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2020-73-0x000000006AF30000-0x000000006AF47000-memory.dmp
    Filesize

    92KB

    Download