Analysis
- max time kernel
29s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/10/2020, 06:54
General
- Target 6be1dbe182a2ce296639ae66f218010d.exe
- Size 772KB
- Sample201031-7691q987fs
- SHA256 46e65e913d85a2d8fa041c2d75b57f8d1790bdfdb38a9d57eb08ced2f6d1416f
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 8 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6be1dbe182a2ce296639ae66f218010d.exe"C:\Users\Admin\AppData\Local\Temp\6be1dbe182a2ce296639ae66f218010d.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 16282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del ""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 16002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 18962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 16322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/212-48-0x0000000005430000-0x0000000005431000-memory.dmp
memory/212-44-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/648-1-0x00000000040B0000-0x00000000040B1000-memory.dmp
memory/648-0-0x0000000002486000-0x0000000002488000-memory.dmp
memory/716-14-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/716-17-0x0000000005270000-0x0000000005271000-memory.dmp
memory/988-2-0x0000000004220000-0x0000000004221000-memory.dmp
memory/988-3-0x0000000004220000-0x0000000004221000-memory.dmp
memory/988-5-0x0000000004950000-0x0000000004951000-memory.dmp
memory/1424-18-0x00000000048C0000-0x00000000048C1000-memory.dmp
memory/1872-36-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1872-45-0x0000000006640000-0x0000000006641000-memory.dmp
memory/1872-60-0x00000000089F0000-0x00000000089F1000-memory.dmp
memory/1872-59-0x0000000008900000-0x0000000008901000-memory.dmp
memory/1872-58-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/1872-57-0x00000000071F0000-0x00000000071F1000-memory.dmp
memory/1872-56-0x0000000007170000-0x0000000007171000-memory.dmp
memory/1872-32-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1872-55-0x00000000070D0000-0x00000000070D1000-memory.dmp
memory/1872-54-0x0000000007520000-0x0000000007521000-memory.dmp
memory/1872-38-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
memory/1872-39-0x00000000725A0000-0x0000000072C8E000-memory.dmp
memory/1872-53-0x0000000006E20000-0x0000000006E21000-memory.dmp
memory/1872-41-0x0000000002E70000-0x0000000002E94000-memory.dmp
memory/1872-42-0x0000000005B30000-0x0000000005B31000-memory.dmp
memory/1872-43-0x00000000054E0000-0x0000000005502000-memory.dmp
memory/1872-52-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/1872-51-0x0000000005670000-0x0000000005671000-memory.dmp
memory/1872-50-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/1872-49-0x0000000005630000-0x0000000005631000-memory.dmp
memory/2840-9-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/2840-6-0x0000000004630000-0x0000000004631000-memory.dmp
memory/3084-13-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/3084-10-0x00000000043C0000-0x00000000043C1000-memory.dmp
memory/3160-40-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/3160-34-0x0000000004770000-0x0000000004771000-memory.dmp
memory/3884-31-0x0000000005420000-0x0000000005421000-memory.dmp
memory/3884-28-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/3972-25-0x0000000072B00000-0x00000000731EE000-memory.dmp
memory/3972-26-0x0000000000D80000-0x0000000000D81000-memory.dmp