Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-11-2020 07:03
General
-
Target
d02075e11831e9b95ca654063a249554.exe
-
Size
780KB
-
MD5
d02075e11831e9b95ca654063a249554
-
SHA1
ce46e830a3bdd48891c67e07786d3523ed89b9f5
-
SHA256
9d7cd70852435e73846e3050cf060d345173d44df492593ea0821d023c0e7f67
-
SHA512
5022601bc9d6436d4ac903d49dee44e89f8bf91eac6b8b240aa511c241946bfa43c312ae9b32b66a9c40e52bf48d06e3b374c4c7088af05eb54bec6e3133f0d6
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 43 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02075e11831e9b95ca654063a249554.exe"C:\Users\Admin\AppData\Local\Temp\d02075e11831e9b95ca654063a249554.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 8322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 15362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 5363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 5443⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 10323⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 10683⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 12883⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 13243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 16082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 18962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 19442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 19482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
memory/496-71-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/496-74-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/992-126-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/992-120-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/1336-109-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/1336-103-0x00000000042C0000-0x00000000042C1000-memory.dmpFilesize
4KB
-
memory/1548-135-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/1548-133-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/1548-130-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/2576-128-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB
-
memory/2576-98-0x0000000000000000-mapping.dmp
-
memory/2576-79-0x0000000000000000-mapping.dmp
-
memory/2576-194-0x0000000000000000-mapping.dmp
-
memory/2576-193-0x0000000000000000-mapping.dmp
-
memory/2576-82-0x0000000002364000-0x0000000002365000-memory.dmpFilesize
4KB
-
memory/2576-83-0x0000000004020000-0x0000000004021000-memory.dmpFilesize
4KB
-
memory/2576-84-0x0000000004020000-0x0000000004021000-memory.dmpFilesize
4KB
-
memory/2576-85-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/2576-86-0x0000000072940000-0x000000007302E000-memory.dmpFilesize
6.9MB
-
memory/2576-192-0x0000000000000000-mapping.dmp
-
memory/2576-191-0x0000000000000000-mapping.dmp
-
memory/2576-92-0x0000000000000000-mapping.dmp
-
memory/2576-94-0x0000000000000000-mapping.dmp
-
memory/2576-95-0x0000000000000000-mapping.dmp
-
memory/2576-93-0x0000000000000000-mapping.dmp
-
memory/2576-189-0x0000000000000000-mapping.dmp
-
memory/2576-97-0x0000000000000000-mapping.dmp
-
memory/2576-99-0x0000000000000000-mapping.dmp
-
memory/2576-188-0x0000000000000000-mapping.dmp
-
memory/2576-100-0x0000000000000000-mapping.dmp
-
memory/2576-179-0x0000000000000000-mapping.dmp
-
memory/2576-186-0x0000000000000000-mapping.dmp
-
memory/2576-110-0x0000000000000000-mapping.dmp
-
memory/2576-111-0x0000000000000000-mapping.dmp
-
memory/2576-112-0x0000000000000000-mapping.dmp
-
memory/2576-185-0x0000000000000000-mapping.dmp
-
memory/2576-143-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/2576-114-0x0000000000000000-mapping.dmp
-
memory/2576-184-0x0000000000000000-mapping.dmp
-
memory/2576-116-0x0000000000000000-mapping.dmp
-
memory/2576-117-0x0000000000000000-mapping.dmp
-
memory/2576-118-0x0000000000000000-mapping.dmp
-
memory/2576-119-0x0000000000000000-mapping.dmp
-
memory/2576-121-0x0000000004200000-0x0000000004224000-memory.dmpFilesize
144KB
-
memory/2576-183-0x0000000000000000-mapping.dmp
-
memory/2576-124-0x00000000068E0000-0x00000000068E1000-memory.dmpFilesize
4KB
-
memory/2576-182-0x0000000000000000-mapping.dmp
-
memory/2576-125-0x0000000006DE0000-0x0000000006E02000-memory.dmpFilesize
136KB
-
memory/2576-127-0x0000000006E10000-0x0000000006E11000-memory.dmpFilesize
4KB
-
memory/2576-181-0x0000000000000000-mapping.dmp
-
memory/2576-129-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/2576-180-0x0000000000000000-mapping.dmp
-
memory/2576-173-0x0000000000000000-mapping.dmp
-
memory/2576-134-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/2576-175-0x0000000000000000-mapping.dmp
-
memory/2576-190-0x0000000000000000-mapping.dmp
-
memory/2576-174-0x0000000000000000-mapping.dmp
-
memory/2576-113-0x0000000000000000-mapping.dmp
-
memory/2576-172-0x0000000000000000-mapping.dmp
-
memory/2576-148-0x0000000000000000-mapping.dmp
-
memory/2576-149-0x0000000000000000-mapping.dmp
-
memory/2576-150-0x0000000000000000-mapping.dmp
-
memory/2576-151-0x0000000000000000-mapping.dmp
-
memory/2576-152-0x0000000000000000-mapping.dmp
-
memory/2576-147-0x0000000000000000-mapping.dmp
-
memory/2576-171-0x0000000000000000-mapping.dmp
-
memory/2576-155-0x0000000000000000-mapping.dmp
-
memory/2576-156-0x0000000000000000-mapping.dmp
-
memory/2576-154-0x0000000000000000-mapping.dmp
-
memory/2576-157-0x0000000000000000-mapping.dmp
-
memory/2576-158-0x0000000000000000-mapping.dmp
-
memory/2576-170-0x0000000000000000-mapping.dmp
-
memory/2576-163-0x0000000000000000-mapping.dmp
-
memory/2576-164-0x0000000000000000-mapping.dmp
-
memory/2576-162-0x0000000000000000-mapping.dmp
-
memory/2576-165-0x0000000000000000-mapping.dmp
-
memory/2576-166-0x0000000000000000-mapping.dmp
-
memory/2576-167-0x0000000000000000-mapping.dmp
-
memory/2576-168-0x0000000000000000-mapping.dmp
-
memory/2632-3-0x00000000044D0000-0x00000000044D1000-memory.dmpFilesize
4KB
-
memory/2632-2-0x00000000044D0000-0x00000000044D1000-memory.dmpFilesize
4KB
-
memory/2632-5-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/2716-89-0x0000000004190000-0x0000000004191000-memory.dmpFilesize
4KB
-
memory/2716-90-0x0000000004190000-0x0000000004191000-memory.dmpFilesize
4KB
-
memory/2716-96-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/3040-10-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/3040-6-0x00000000044D0000-0x00000000044D1000-memory.dmpFilesize
4KB
-
memory/3088-176-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/3088-187-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/3132-0-0x0000000002596000-0x0000000002598000-memory.dmpFilesize
8KB
-
memory/3132-1-0x0000000004020000-0x0000000004021000-memory.dmpFilesize
4KB
-
memory/3432-139-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/3432-142-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/3636-67-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB
-
memory/3636-70-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/3728-144-0x0000000004190000-0x0000000004191000-memory.dmpFilesize
4KB
-
memory/3728-153-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/3744-105-0x00000000045C0000-0x00000000045C1000-memory.dmpFilesize
4KB
-
memory/3744-115-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/3836-78-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/3836-75-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/3900-159-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/3900-169-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB