Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-11-2020 07:21
General
-
Target
b89909ca38cc8db3dfed14f8fbf992d3.exe
-
Size
789KB
-
MD5
b89909ca38cc8db3dfed14f8fbf992d3
-
SHA1
7f41456dd12f38cc6b18dc73d130a86df82f2614
-
SHA256
1902d4a7a8bc2008c71d9806065bc9b8ec069169fc6eb61a64799dab46aaef3c
-
SHA512
81da8d01f3bad0c763de1bd4fcdf70bd540ff7f321013451a1b1025ffcfba5e1e1e1f57a77e9456bf41c1d1d9f7d6558f3edaac82e7650d7428d6180c895312f
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 47 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b89909ca38cc8db3dfed14f8fbf992d3.exe"C:\Users\Admin\AppData\Local\Temp\b89909ca38cc8db3dfed14f8fbf992d3.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 7682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 16282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 15762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 6603⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 10163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 10283⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 12843⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 16002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 19162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 16402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
memory/1288-51-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/1288-62-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/1564-35-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1564-34-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1564-42-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/1784-133-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/1784-124-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/2008-2-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/2008-3-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/2008-5-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/2152-87-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/2152-84-0x0000000004490000-0x0000000004491000-memory.dmpFilesize
4KB
-
memory/2152-72-0x0000000004490000-0x0000000004491000-memory.dmpFilesize
4KB
-
memory/2224-109-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/2224-101-0x00000000045A0000-0x00000000045A1000-memory.dmpFilesize
4KB
-
memory/2508-48-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/2508-52-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/2684-13-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/2684-10-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/2692-6-0x0000000004620000-0x0000000004621000-memory.dmpFilesize
4KB
-
memory/2692-9-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/3144-14-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3144-17-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3732-25-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/3732-22-0x00000000046E0000-0x00000000046E1000-memory.dmpFilesize
4KB
-
memory/3808-116-0x0000000000000000-mapping.dmp
-
memory/3808-127-0x0000000000000000-mapping.dmp
-
memory/3808-40-0x0000000000000000-mapping.dmp
-
memory/3808-43-0x0000000000000000-mapping.dmp
-
memory/3808-44-0x0000000000000000-mapping.dmp
-
memory/3808-45-0x0000000000000000-mapping.dmp
-
memory/3808-46-0x0000000000000000-mapping.dmp
-
memory/3808-47-0x0000000000000000-mapping.dmp
-
memory/3808-38-0x0000000000000000-mapping.dmp
-
memory/3808-39-0x0000000000000000-mapping.dmp
-
memory/3808-37-0x0000000000000000-mapping.dmp
-
memory/3808-55-0x0000000000000000-mapping.dmp
-
memory/3808-56-0x0000000000000000-mapping.dmp
-
memory/3808-57-0x0000000000000000-mapping.dmp
-
memory/3808-58-0x0000000000000000-mapping.dmp
-
memory/3808-60-0x0000000000000000-mapping.dmp
-
memory/3808-59-0x0000000000000000-mapping.dmp
-
memory/3808-33-0x0000000072A00000-0x00000000730EE000-memory.dmpFilesize
6.9MB
-
memory/3808-32-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/3808-31-0x0000000003FC0000-0x0000000003FF2000-memory.dmpFilesize
200KB
-
memory/3808-30-0x0000000003FC0000-0x0000000003FC1000-memory.dmpFilesize
4KB
-
memory/3808-29-0x00000000023B4000-0x00000000023B5000-memory.dmpFilesize
4KB
-
memory/3808-26-0x0000000000000000-mapping.dmp
-
memory/3808-112-0x0000000000000000-mapping.dmp
-
memory/3808-113-0x0000000000000000-mapping.dmp
-
memory/3808-114-0x0000000000000000-mapping.dmp
-
memory/3808-115-0x0000000000000000-mapping.dmp
-
memory/3808-172-0x0000000000000000-mapping.dmp
-
memory/3808-117-0x0000000004300000-0x0000000004324000-memory.dmpFilesize
144KB
-
memory/3808-118-0x0000000006AB0000-0x0000000006AB1000-memory.dmpFilesize
4KB
-
memory/3808-119-0x00000000044C0000-0x00000000044E2000-memory.dmpFilesize
136KB
-
memory/3808-120-0x0000000006FB0000-0x0000000006FB1000-memory.dmpFilesize
4KB
-
memory/3808-121-0x00000000075C0000-0x00000000075C1000-memory.dmpFilesize
4KB
-
memory/3808-122-0x0000000006A80000-0x0000000006A81000-memory.dmpFilesize
4KB
-
memory/3808-123-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/3808-175-0x0000000000000000-mapping.dmp
-
memory/3808-128-0x0000000000000000-mapping.dmp
-
memory/3808-129-0x0000000000000000-mapping.dmp
-
memory/3808-130-0x0000000000000000-mapping.dmp
-
memory/3808-131-0x0000000000000000-mapping.dmp
-
memory/3808-132-0x0000000000000000-mapping.dmp
-
memory/3808-41-0x0000000000000000-mapping.dmp
-
memory/3808-174-0x0000000000000000-mapping.dmp
-
memory/3808-134-0x0000000000000000-mapping.dmp
-
memory/3808-135-0x0000000000000000-mapping.dmp
-
memory/3808-136-0x0000000000000000-mapping.dmp
-
memory/3808-137-0x0000000000000000-mapping.dmp
-
memory/3808-138-0x0000000000000000-mapping.dmp
-
memory/3808-173-0x0000000000000000-mapping.dmp
-
memory/3808-171-0x0000000000000000-mapping.dmp
-
memory/3808-143-0x0000000000000000-mapping.dmp
-
memory/3808-144-0x0000000000000000-mapping.dmp
-
memory/3808-145-0x0000000000000000-mapping.dmp
-
memory/3808-146-0x0000000000000000-mapping.dmp
-
memory/3808-147-0x0000000000000000-mapping.dmp
-
memory/3808-148-0x0000000000000000-mapping.dmp
-
memory/3808-142-0x0000000000000000-mapping.dmp
-
memory/3808-170-0x0000000000000000-mapping.dmp
-
memory/3808-150-0x0000000000000000-mapping.dmp
-
memory/3808-151-0x0000000000000000-mapping.dmp
-
memory/3808-152-0x0000000000000000-mapping.dmp
-
memory/3808-153-0x0000000000000000-mapping.dmp
-
memory/3808-155-0x0000000000000000-mapping.dmp
-
memory/3808-154-0x0000000007B10000-0x0000000007B11000-memory.dmpFilesize
4KB
-
memory/3808-156-0x0000000000000000-mapping.dmp
-
memory/3808-169-0x0000000000000000-mapping.dmp
-
memory/3808-161-0x0000000000000000-mapping.dmp
-
memory/3808-162-0x0000000000000000-mapping.dmp
-
memory/3808-163-0x0000000000000000-mapping.dmp
-
memory/3808-164-0x0000000000000000-mapping.dmp
-
memory/3808-165-0x0000000000000000-mapping.dmp
-
memory/3808-166-0x0000000000000000-mapping.dmp
-
memory/3808-160-0x0000000000000000-mapping.dmp
-
memory/3808-167-0x0000000000000000-mapping.dmp
-
memory/3820-168-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/3820-157-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/3968-0-0x000000000268B000-0x000000000268D000-memory.dmpFilesize
8KB
-
memory/3968-1-0x00000000041D0000-0x00000000041D1000-memory.dmpFilesize
4KB
-
memory/4048-21-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4048-18-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/4076-149-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/4076-139-0x0000000004490000-0x0000000004491000-memory.dmpFilesize
4KB