Overview

overview

10

Static

static

setup/AISe...ck.exe

windows7_x64

10

setup/AISe...ck.exe

windows10-2004_x64

10

setup/Pre-...up.exe

windows7_x64

10

setup/Pre-...up.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    80s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup/AISetup-Crack.exe

  • Size

    2.4MB

  • MD5

    be7879386bb4db5b6c8415166db67ef8

  • SHA1

    ddd3021057a36b9f3298abc2844c3905652a9429

  • SHA256

    9871a54a96e578971bde616e6110d08c60d1644734f72358ef04885d16c73d99

  • SHA512

    4b0d06d882df5badbcd6d4445f8d3d4fc4db1fe7ec87018c316e9a0cf49e3e04c9c1459150d18613e5af0327b42d7f42a3eef174e35af6a436d2b903373bd9cc

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3848-130-0x0000000000770000-0x00000000009AD000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3848-131-0x0000000000770000-0x00000000009AD000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3848-132-0x0000000076DA0000-0x0000000076FB5000-memory.dmp
    Filesize

    2.1MB

    Download
  • memory/3848-133-0x0000000002840000-0x0000000002881000-memory.dmp
    Filesize

    260KB

    Download
  • memory/3848-134-0x0000000000770000-0x00000000009AD000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3848-135-0x0000000000770000-0x00000000009AD000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/3848-136-0x0000000072AE0000-0x0000000072B69000-memory.dmp
    Filesize

    548KB

    Download
  • memory/3848-137-0x0000000076780000-0x0000000076D33000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3848-138-0x0000000005910000-0x0000000005F28000-memory.dmp
    Filesize

    6.1MB

    Download
  • memory/3848-139-0x0000000002F80000-0x0000000002F92000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3848-140-0x00000000052F0000-0x00000000053FA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3848-141-0x00000000050F0000-0x000000000512C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/3848-142-0x000000006E2F0000-0x000000006E33C000-memory.dmp
    Filesize

    304KB

    Download
  • memory/3848-143-0x00000000064E0000-0x0000000006A84000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/3848-144-0x00000000055A0000-0x0000000005632000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3848-145-0x0000000005640000-0x00000000056A6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3848-146-0x00000000060C0000-0x0000000006136000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3848-147-0x00000000061C0000-0x00000000061DE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3848-148-0x0000000006C60000-0x0000000006E22000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3848-149-0x0000000007360000-0x000000000788C000-memory.dmp
    Filesize

    5.2MB

    Download