Modifies security service

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

XMRig Miner payload

Blocklisted process makes network request

Downloads MZ/PE file

Drops file in Drivers directory

Executes dropped EXE

Stops running service(s)

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.