Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10_x64 -
resource
win10 -
submitted
28-10-2020 02:02
General
-
Target
SecuriteInfo.com.Artemis6F952B81A92F.13442.exe
-
Size
745KB
-
MD5
6f952b81a92f7f780923635648b428c0
-
SHA1
6c82f9a7c8667e92fe067789b8bceed727017b02
-
SHA256
b185c97cf356748005cda3b4ccb5a6df0e059c8869ba3b3f33595984bb60f380
-
SHA512
76019d90a1c6142e9167561088e649b1d62366e81654c34b93b74ad36dc6d5a3f38f61e9cb987040dcda8ca11521a496fcb5b5857b724f53bbd2eb3cda7bc994
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 47 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis6F952B81A92F.13442.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis6F952B81A92F.13442.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 6643⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 11763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 12763⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 13443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 16082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 19002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 16802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER233D.tmp.WERInternalMetadata.xmlMD5
73698b419aba5b3501b0fd73bb22f89f
SHA13503ef377ba23eaa813a5f1c202a32e4da8207d0
SHA256f5f0ff7ded15f81d4721ae32afd1f5a7ecdb6192c91af7fd49195f2aaf183a33
SHA512e81f81f80ac7a6906be28aebf3f7a1c3b18fdce3195f693e719d882c60e8d6a0bf0a4719d89fee0ed399bdfb8649d9198867e63140c66bce4fda93ff39cbe054
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER233D.tmp.WERInternalMetadata.xmlMD5
b09d9d7f97cddc7415d8a33a370fd85d
SHA1448c697f51ffd6d4d8fa92ca3e5528e366fa55ab
SHA256e4e06f6e3761d63af716206bd9e078c55c1fef3498051e15905ab20dacc3e12e
SHA51266fb847bd5406234fbb23cdd476f78945a45c8dcd8528c1bd82f9df7e1241644b7ad6bcdf79de9e95a16ad69d0966e8cab8430cb08799ed6bf62951052419e33
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
8d330917b4d7220eb231327236f93c95
SHA1467b49d82b4330ebea65b8b529fd101f371d7c9e
SHA256e956a58b3dfb4b71d0fddad3a02ffd5cc0c3413684b59e2f9f14fd3626250f1d
SHA512bbdad8394440ca08182212409a36f140853c65fbd2040f0f8cfd297c8e4c8a9334783325c9b0127c2703f5cc63eaaf664875be2781c0ea87c783e8f490367127
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
8d330917b4d7220eb231327236f93c95
SHA1467b49d82b4330ebea65b8b529fd101f371d7c9e
SHA256e956a58b3dfb4b71d0fddad3a02ffd5cc0c3413684b59e2f9f14fd3626250f1d
SHA512bbdad8394440ca08182212409a36f140853c65fbd2040f0f8cfd297c8e4c8a9334783325c9b0127c2703f5cc63eaaf664875be2781c0ea87c783e8f490367127
-
memory/208-91-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/208-80-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/908-111-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/908-99-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1580-120-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/1988-3-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/1988-5-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/1988-2-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/2516-17-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/2516-14-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/3340-6-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/3340-9-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/3588-29-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/3588-30-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/3588-37-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/4004-68-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/4004-85-0x0000000000000000-mapping.dmp
-
memory/4004-36-0x0000000000000000-mapping.dmp
-
memory/4004-38-0x0000000000000000-mapping.dmp
-
memory/4004-39-0x0000000000000000-mapping.dmp
-
memory/4004-40-0x0000000000000000-mapping.dmp
-
memory/4004-41-0x0000000000000000-mapping.dmp
-
memory/4004-42-0x0000000000000000-mapping.dmp
-
memory/4004-128-0x0000000000000000-mapping.dmp
-
memory/4004-46-0x0000000000000000-mapping.dmp
-
memory/4004-47-0x0000000000000000-mapping.dmp
-
memory/4004-125-0x0000000000000000-mapping.dmp
-
memory/4004-126-0x0000000000000000-mapping.dmp
-
memory/4004-124-0x0000000000000000-mapping.dmp
-
memory/4004-49-0x0000000000000000-mapping.dmp
-
memory/4004-53-0x0000000000000000-mapping.dmp
-
memory/4004-52-0x0000000000000000-mapping.dmp
-
memory/4004-54-0x0000000000000000-mapping.dmp
-
memory/4004-123-0x0000000000000000-mapping.dmp
-
memory/4004-34-0x0000000000000000-mapping.dmp
-
memory/4004-22-0x0000000000000000-mapping.dmp
-
memory/4004-33-0x0000000000000000-mapping.dmp
-
memory/4004-59-0x0000000000000000-mapping.dmp
-
memory/4004-60-0x0000000000000000-mapping.dmp
-
memory/4004-61-0x0000000000000000-mapping.dmp
-
memory/4004-62-0x0000000000000000-mapping.dmp
-
memory/4004-63-0x0000000000000000-mapping.dmp
-
memory/4004-64-0x0000000002CE0000-0x0000000002D05000-memory.dmpFilesize
148KB
-
memory/4004-65-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/4004-66-0x0000000002EA0000-0x0000000002EC4000-memory.dmpFilesize
144KB
-
memory/4004-67-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/4004-32-0x0000000000000000-mapping.dmp
-
memory/4004-119-0x0000000000000000-mapping.dmp
-
memory/4004-72-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/4004-117-0x0000000000000000-mapping.dmp
-
memory/4004-74-0x0000000005F40000-0x0000000005F41000-memory.dmpFilesize
4KB
-
memory/4004-118-0x0000000000000000-mapping.dmp
-
memory/4004-116-0x0000000000000000-mapping.dmp
-
memory/4004-79-0x00000000061C0000-0x00000000061C1000-memory.dmpFilesize
4KB
-
memory/4004-28-0x00000000723B0000-0x0000000072A9E000-memory.dmpFilesize
6.9MB
-
memory/4004-83-0x0000000000000000-mapping.dmp
-
memory/4004-35-0x0000000000000000-mapping.dmp
-
memory/4004-86-0x0000000000000000-mapping.dmp
-
memory/4004-87-0x0000000000000000-mapping.dmp
-
memory/4004-88-0x0000000000000000-mapping.dmp
-
memory/4004-84-0x0000000000000000-mapping.dmp
-
memory/4004-90-0x0000000000000000-mapping.dmp
-
memory/4004-89-0x0000000000000000-mapping.dmp
-
memory/4004-27-0x0000000002B80000-0x0000000002B81000-memory.dmpFilesize
4KB
-
memory/4004-96-0x0000000000000000-mapping.dmp
-
memory/4004-95-0x0000000000000000-mapping.dmp
-
memory/4004-94-0x0000000000000000-mapping.dmp
-
memory/4004-93-0x0000000000000000-mapping.dmp
-
memory/4004-92-0x0000000000000000-mapping.dmp
-
memory/4004-97-0x0000000000000000-mapping.dmp
-
memory/4004-98-0x0000000000000000-mapping.dmp
-
memory/4004-26-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/4004-103-0x0000000000000000-mapping.dmp
-
memory/4004-104-0x0000000000000000-mapping.dmp
-
memory/4004-105-0x0000000000000000-mapping.dmp
-
memory/4004-106-0x0000000000000000-mapping.dmp
-
memory/4004-107-0x0000000000000000-mapping.dmp
-
memory/4004-108-0x0000000000000000-mapping.dmp
-
memory/4004-109-0x0000000000000000-mapping.dmp
-
memory/4004-110-0x0000000000000000-mapping.dmp
-
memory/4004-102-0x0000000000000000-mapping.dmp
-
memory/4004-25-0x0000000000C75000-0x0000000000C76000-memory.dmpFilesize
4KB
-
memory/4004-112-0x0000000000000000-mapping.dmp
-
memory/4004-113-0x0000000000000000-mapping.dmp
-
memory/4004-114-0x0000000000000000-mapping.dmp
-
memory/4004-115-0x0000000000000000-mapping.dmp
-
memory/4040-55-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4040-43-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/4160-18-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/4328-10-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/4416-78-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/4416-75-0x0000000004190000-0x0000000004191000-memory.dmpFilesize
4KB
-
memory/4516-56-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/4516-48-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/4728-73-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/4728-69-0x0000000004420000-0x0000000004421000-memory.dmpFilesize
4KB
-
memory/4756-0-0x0000000000F56000-0x0000000000F57000-memory.dmpFilesize
4KB
-
memory/4756-1-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB