0e486871aeddade1498c575341b53401d74af20bf4cf9103b8d1f9596d852673 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 18:43

Sharing

Report Analysis Logs

General

Target

Redlinestealer2020-main.zip
Size

2.5MB
MD5

291c143340623d5ddd9895e3173970cf
SHA1

64603a6f1fa74412e91fa20688f213d13b1dff40
SHA256

0e486871aeddade1498c575341b53401d74af20bf4cf9103b8d1f9596d852673
SHA512

4a226b9ca9c86cedcb677830551207fb5e4fe54f1e0959e4dc97581c1375416934d9a61570ddc6a7fab7acce0ef8d9cb4251de69b70d8780891f4b8f109eb6c7
SSDEEP

49152:BZiaJLFXJVKGIub4kSAQOXJ6kVViwBE2x6eni8mZw7/8Z:BZiaJtJVKGckSUdhBE/eiXOU

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3032	7zFM.exe
Token: 35	3032	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Redlinestealer2020-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads