Overview

overview

10

Static

static

setup/AISe...ck.exe

windows7_x64

10

setup/AISe...ck.exe

windows10-2004_x64

10

setup/Pre-...up.exe

windows7_x64

10

setup/Pre-...up.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 11:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup/AISetup-Crack.exe

  • Size

    2.4MB

  • MD5

    a6f2af8aa201a51b90ce7242736a7af4

  • SHA1

    303184b65412f10df9e3860a7b3337e165c820db

  • SHA256

    7e29a55958df55dcc4bb4e563111659226cdac60bc7141f8124acaa8eac66565

  • SHA512

    dd5271e62bb7f69b217ea912c378cccf41f4132efe48e4ac11fe04d6869d3db13cc52dd991507d1ba081b88bcbc8c96324a11d7a1623937be2a0403c353d7650

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3284-130-0x00000000001A0000-0x00000000003E8000-memory.dmp
    Filesize

    2.3MB

    Download
  • memory/3284-131-0x00000000001A0000-0x00000000003E8000-memory.dmp
    Filesize

    2.3MB

    Download
  • memory/3284-132-0x0000000002580000-0x00000000025C1000-memory.dmp
    Filesize

    260KB

    Download
  • memory/3284-133-0x00000000001A0000-0x00000000003E8000-memory.dmp
    Filesize

    2.3MB

    Download
  • memory/3284-134-0x00000000762E0000-0x00000000764F5000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/3284-135-0x00000000001A0000-0x00000000003E8000-memory.dmp
    Filesize

    2.3MB

    Download
  • memory/3284-136-0x0000000072BE0000-0x0000000072C69000-memory.dmp
    Filesize

    548KB

    Download
  • memory/3284-137-0x0000000076840000-0x0000000076DF3000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3284-138-0x00000000055E0000-0x0000000005BF8000-memory.dmp
    Filesize

    6.1MB

    Download
  • memory/3284-139-0x0000000002CE0000-0x0000000002CF2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3284-140-0x0000000004FC0000-0x00000000050CA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3284-141-0x0000000004E60000-0x0000000004E9C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/3284-142-0x000000006E3F0000-0x000000006E43C000-memory.dmp
    Filesize

    304KB

    Download
  • memory/3284-143-0x00000000061B0000-0x0000000006754000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/3284-144-0x00000000052E0000-0x0000000005372000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3284-145-0x0000000005380000-0x00000000053F6000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3284-146-0x0000000005590000-0x00000000055AE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3284-147-0x0000000005D70000-0x0000000005DD6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3284-148-0x0000000006930000-0x0000000006AF2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3284-149-0x0000000007030000-0x000000000755C000-memory.dmp
    Filesize

    5.2MB

    Download