Analysis
- max time kernel
124s - max time network
124s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/10/2020, 06:50
General
- Target 8b214cfd6d347214efae2cdd169d7941.exe
- Size 779KB
- Sample201031-586nnlpfs2
- SHA256 73c6f12cbbdf012d580ce17f84cc337b4fc6bc9de0fde4f838585b1db9745331
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 8 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b214cfd6d347214efae2cdd169d7941.exe"C:\Users\Admin\AppData\Local\Temp\8b214cfd6d347214efae2cdd169d7941.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 8842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 12122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 15442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del ""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 16122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 19002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 18242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/400-92-0x0000000004A80000-0x0000000004A81000-memory.dmp
memory/400-95-0x0000000005330000-0x0000000005331000-memory.dmp
memory/908-77-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-81-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-67-0x0000000004320000-0x0000000004321000-memory.dmp
memory/908-70-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-72-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-73-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-71-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-74-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-75-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-76-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-84-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-79-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-80-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-86-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-78-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-82-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-83-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-85-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-87-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-89-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-88-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-91-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/908-90-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/988-10-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/988-6-0x00000000048D0000-0x00000000048D1000-memory.dmp
memory/1056-116-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/1056-133-0x0000000007340000-0x0000000007341000-memory.dmp
memory/1056-140-0x0000000008E10000-0x0000000008E11000-memory.dmp
memory/1056-139-0x0000000008D20000-0x0000000008D21000-memory.dmp
memory/1056-138-0x00000000078B0000-0x00000000078B1000-memory.dmp
memory/1056-137-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/1056-136-0x00000000072A0000-0x00000000072A1000-memory.dmp
memory/1056-135-0x0000000007510000-0x0000000007511000-memory.dmp
memory/1056-134-0x0000000007A40000-0x0000000007A41000-memory.dmp
memory/1056-106-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1056-108-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1056-109-0x0000000003280000-0x0000000003281000-memory.dmp
memory/1056-110-0x0000000072D70000-0x000000007345E000-memory.dmp
memory/1056-111-0x0000000003200000-0x0000000003224000-memory.dmp
memory/1056-112-0x0000000005E50000-0x0000000005E51000-memory.dmp
memory/1056-113-0x0000000003570000-0x0000000003592000-memory.dmp
memory/1056-114-0x0000000006960000-0x0000000006961000-memory.dmp
memory/1056-115-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/1056-126-0x0000000005CA0000-0x0000000005CA1000-memory.dmp
memory/1056-120-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/1304-1-0x0000000003FF0000-0x0000000003FF1000-memory.dmp
memory/1304-0-0x0000000002566000-0x0000000002568000-memory.dmp
memory/1444-96-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/1444-99-0x0000000005180000-0x0000000005181000-memory.dmp
memory/1456-122-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/1456-125-0x0000000005180000-0x0000000005181000-memory.dmp
memory/3172-104-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
memory/3172-103-0x0000000072D70000-0x000000007345E000-memory.dmp
memory/3176-130-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/3176-127-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/3440-2-0x00000000047C0000-0x00000000047C1000-memory.dmp
memory/3440-3-0x00000000047C0000-0x00000000047C1000-memory.dmp
memory/3656-117-0x0000000004540000-0x0000000004541000-memory.dmp
memory/3656-121-0x0000000004C70000-0x0000000004C71000-memory.dmp