Analysis
-
max time kernel
21s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
14-04-2022 14:47
General
-
Target
Discord Nitro Generator.exe
-
Size
1.8MB
-
MD5
c28de7f93469b90ca01ebb61f06abb83
-
SHA1
06fd9ae38aba81c5e1d0d35c25ee595d7b42ec67
-
SHA256
d90a676155980ede43b02a6d9f7d793a138dac32157b40b7b567b76a5eb581c8
-
SHA512
046c052842f3c33b535378997f03f07f7bbcab7e127b2c8d6aa452b84f8090c9954febc71d42b97daf496745b4e6de2a4b368bf316351ea3af3b9cba6b4aa014
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
1135890973
C2
37.1.213.9:17292
Attributes
-
auth_value
1c94da41d44c0642760a7ba23cfb6d24
Signatures
-
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.exe"C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
1.8MB
-
Filesize
5.2MB