Analysis
-
max time kernel
26s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 11:31
General
-
Target
setup/AISetup-Crack.exe
-
Size
2.4MB
-
MD5
a6f2af8aa201a51b90ce7242736a7af4
-
SHA1
303184b65412f10df9e3860a7b3337e165c820db
-
SHA256
7e29a55958df55dcc4bb4e563111659226cdac60bc7141f8124acaa8eac66565
-
SHA512
dd5271e62bb7f69b217ea912c378cccf41f4132efe48e4ac11fe04d6869d3db13cc52dd991507d1ba081b88bcbc8c96324a11d7a1623937be2a0403c353d7650
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe"C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/948-55-0x0000000074C00000-0x0000000074C4A000-memory.dmpFilesize
296KB
-
memory/948-56-0x0000000000BD0000-0x0000000000E18000-memory.dmpFilesize
2.3MB
-
memory/948-57-0x0000000000BD0000-0x0000000000E18000-memory.dmpFilesize
2.3MB
-
memory/948-59-0x00000000002D0000-0x0000000000311000-memory.dmpFilesize
260KB
-
memory/948-61-0x0000000000BD0000-0x0000000000E18000-memory.dmpFilesize
2.3MB
-
memory/948-60-0x0000000076CF0000-0x0000000076D9C000-memory.dmpFilesize
688KB
-
memory/948-62-0x0000000075C70000-0x0000000075CB7000-memory.dmpFilesize
284KB
-
memory/948-63-0x0000000076070000-0x00000000760C7000-memory.dmpFilesize
348KB
-
memory/948-64-0x0000000074AD0000-0x0000000074AD9000-memory.dmpFilesize
36KB
-
memory/948-65-0x0000000075C70000-0x0000000075CB7000-memory.dmpFilesize
284KB
-
memory/948-68-0x0000000000BD0000-0x0000000000E18000-memory.dmpFilesize
2.3MB
-
memory/948-67-0x0000000075CC0000-0x0000000075E1C000-memory.dmpFilesize
1.4MB
-
memory/948-69-0x00000000764F0000-0x000000007657F000-memory.dmpFilesize
572KB
-
memory/948-70-0x0000000074940000-0x00000000749C0000-memory.dmpFilesize
512KB
-
memory/948-71-0x0000000074F20000-0x0000000075B6A000-memory.dmpFilesize
12.3MB
-
memory/948-72-0x000000006D0C0000-0x000000006D0D7000-memory.dmpFilesize
92KB
-
memory/948-73-0x0000000076E00000-0x0000000076E35000-memory.dmpFilesize
212KB
-
memory/948-74-0x000000006BE90000-0x000000006C020000-memory.dmpFilesize
1.6MB
-
memory/948-75-0x000000006A970000-0x000000006A987000-memory.dmpFilesize
92KB