Analysis
- max time kernel
138s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
30/10/2020, 19:33
General
- Target 01220b18bf1384bf2db8686425da2ae0.exe
- Size 779KB
- Sample201030-rcxvhatlfa
- SHA256 13ca4ce027439580ff4a68cdee4a2c33ec62ab6be39441d9416e7c2bc3ac40bd
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 9 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01220b18bf1384bf2db8686425da2ae0.exe"C:\Users\Admin\AppData\Local\Temp\01220b18bf1384bf2db8686425da2ae0.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 8522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 12122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 12162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 15922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 15562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exe"C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 15522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 19722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 16322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/204-39-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/204-42-0x0000000005750000-0x0000000005751000-memory.dmp
memory/580-46-0x0000000005480000-0x0000000005481000-memory.dmp
memory/580-43-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/632-0-0x00000000026B6000-0x00000000026B8000-memory.dmp
memory/632-1-0x00000000041C0000-0x00000000041C1000-memory.dmp
memory/688-14-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/688-13-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/688-10-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1204-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/1204-9-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/1528-35-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/1528-38-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/1908-18-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/1908-15-0x00000000046A0000-0x00000000046A1000-memory.dmp
memory/2088-58-0x0000000005630000-0x0000000005631000-memory.dmp
memory/2088-64-0x0000000007CC0000-0x0000000007CC1000-memory.dmp
memory/2088-69-0x0000000008C70000-0x0000000008C71000-memory.dmp
memory/2088-68-0x0000000007B60000-0x0000000007B61000-memory.dmp
memory/2088-67-0x00000000070B0000-0x00000000070B1000-memory.dmp
memory/2088-66-0x0000000006E00000-0x0000000006E01000-memory.dmp
memory/2088-65-0x0000000006E80000-0x0000000006E81000-memory.dmp
memory/2088-63-0x0000000006D60000-0x0000000006D61000-memory.dmp
memory/2088-62-0x0000000007290000-0x0000000007291000-memory.dmp
memory/2088-49-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2088-61-0x0000000006B90000-0x0000000006B91000-memory.dmp
memory/2088-60-0x0000000005910000-0x0000000005911000-memory.dmp
memory/2088-53-0x0000000072B00000-0x00000000731EE000-memory.dmp
memory/2088-56-0x0000000005C40000-0x0000000005C41000-memory.dmp
memory/2088-57-0x0000000005670000-0x0000000005671000-memory.dmp
memory/2088-59-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/2860-5-0x0000000004800000-0x0000000004801000-memory.dmp
memory/2860-3-0x00000000043D0000-0x00000000043D1000-memory.dmp
memory/2860-2-0x00000000043D0000-0x00000000043D1000-memory.dmp
memory/3168-19-0x0000000004590000-0x0000000004591000-memory.dmp
memory/3168-22-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/3700-28-0x0000000004850000-0x0000000004851000-memory.dmp
memory/3700-23-0x0000000004760000-0x0000000004761000-memory.dmp
memory/3956-48-0x0000000004F80000-0x0000000004F96000-memory.dmp
memory/3956-32-0x0000000072B00000-0x00000000731EE000-memory.dmp
memory/3956-33-0x0000000000410000-0x0000000000411000-memory.dmp
memory/3956-47-0x0000000005120000-0x000000000515A000-memory.dmp