Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-11-2020 06:50
Static task
static1
Behavioral task
behavioral1
Sample
f59ce75e906cc93d49e938df886d1c68.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f59ce75e906cc93d49e938df886d1c68.exe
Resource
win10v20201028
General
-
Target
f59ce75e906cc93d49e938df886d1c68.exe
-
Size
796KB
-
MD5
f59ce75e906cc93d49e938df886d1c68
-
SHA1
694063b4a344d2ea2deecc59b7deaa69e9037461
-
SHA256
3199411c6b716321009ffc3c3ccd88b406d2f90b9504bf147647c8e3c7773578
-
SHA512
038742fa6896fba93f6773aef2264d441159eac054e5602005037ee7df2f8d2906d0081998c4ae7a03ae2c4194bb7d23c185e5809635659e09490d8623d90df5
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 41 IoCs
Processes:
resource yara_rule behavioral2/memory/1340-38-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-37-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-39-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-40-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-41-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-46-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-48-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-47-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-49-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-50-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-75-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-76-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-79-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-81-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-83-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-85-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-94-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-97-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-99-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-101-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-103-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-115-0x0000000004080000-0x00000000040A4000-memory.dmp family_redline behavioral2/memory/1340-125-0x0000000004460000-0x0000000004482000-memory.dmp family_redline behavioral2/memory/1340-164-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-165-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-166-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-167-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-168-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-163-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-225-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-226-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-227-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-228-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-229-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-235-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-233-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-237-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-238-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-239-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-236-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/1340-234-0x0000000000000000-mapping.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
bestof.exepid process 1340 bestof.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3712 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 3732 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 204 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 2372 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 2680 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 3932 1340 WerFault.exe bestof.exe 4076 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 3008 1340 WerFault.exe bestof.exe 1364 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 2696 636 WerFault.exe f59ce75e906cc93d49e938df886d1c68.exe 3468 1340 WerFault.exe bestof.exe 2268 1340 WerFault.exe bestof.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
f59ce75e906cc93d49e938df886d1c68.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f59ce75e906cc93d49e938df886d1c68.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f59ce75e906cc93d49e938df886d1c68.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 3732 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2372 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exebestof.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3712 WerFault.exe Token: SeBackupPrivilege 3712 WerFault.exe Token: SeDebugPrivilege 3712 WerFault.exe Token: SeDebugPrivilege 3732 WerFault.exe Token: SeDebugPrivilege 204 WerFault.exe Token: SeDebugPrivilege 2372 WerFault.exe Token: SeDebugPrivilege 2680 WerFault.exe Token: SeDebugPrivilege 3932 WerFault.exe Token: SeDebugPrivilege 4076 WerFault.exe Token: SeDebugPrivilege 3008 WerFault.exe Token: SeDebugPrivilege 1364 WerFault.exe Token: SeDebugPrivilege 2696 WerFault.exe Token: SeDebugPrivilege 1340 bestof.exe Token: SeDebugPrivilege 3468 WerFault.exe Token: SeDebugPrivilege 2268 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f59ce75e906cc93d49e938df886d1c68.exedescription pid process target process PID 636 wrote to memory of 1340 636 f59ce75e906cc93d49e938df886d1c68.exe bestof.exe PID 636 wrote to memory of 1340 636 f59ce75e906cc93d49e938df886d1c68.exe bestof.exe PID 636 wrote to memory of 1340 636 f59ce75e906cc93d49e938df886d1c68.exe bestof.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f59ce75e906cc93d49e938df886d1c68.exe"C:\Users\Admin\AppData\Local\Temp\f59ce75e906cc93d49e938df886d1c68.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 5443⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 5483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 10483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 10963⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 15602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 19402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
memory/204-10-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/204-13-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/636-1-0x0000000004270000-0x0000000004271000-memory.dmpFilesize
4KB
-
memory/636-0-0x000000000267B000-0x000000000267D000-memory.dmpFilesize
8KB
-
memory/1340-165-0x0000000000000000-mapping.dmp
-
memory/1340-47-0x0000000000000000-mapping.dmp
-
memory/1340-308-0x0000000000000000-mapping.dmp
-
memory/1340-304-0x0000000000000000-mapping.dmp
-
memory/1340-305-0x0000000000000000-mapping.dmp
-
memory/1340-306-0x0000000000000000-mapping.dmp
-
memory/1340-307-0x0000000000000000-mapping.dmp
-
memory/1340-234-0x0000000000000000-mapping.dmp
-
memory/1340-23-0x0000000000000000-mapping.dmp
-
memory/1340-236-0x0000000000000000-mapping.dmp
-
memory/1340-239-0x0000000000000000-mapping.dmp
-
memory/1340-26-0x00000000024A4000-0x00000000024A5000-memory.dmpFilesize
4KB
-
memory/1340-27-0x0000000003FF0000-0x0000000003FF1000-memory.dmpFilesize
4KB
-
memory/1340-28-0x0000000003FF0000-0x0000000003FF1000-memory.dmpFilesize
4KB
-
memory/1340-29-0x00000000043E0000-0x00000000043E1000-memory.dmpFilesize
4KB
-
memory/1340-238-0x0000000000000000-mapping.dmp
-
memory/1340-237-0x0000000000000000-mapping.dmp
-
memory/1340-31-0x0000000072EE0000-0x00000000735CE000-memory.dmpFilesize
6.9MB
-
memory/1340-38-0x0000000000000000-mapping.dmp
-
memory/1340-37-0x0000000000000000-mapping.dmp
-
memory/1340-39-0x0000000000000000-mapping.dmp
-
memory/1340-40-0x0000000000000000-mapping.dmp
-
memory/1340-41-0x0000000000000000-mapping.dmp
-
memory/1340-233-0x0000000000000000-mapping.dmp
-
memory/1340-235-0x0000000000000000-mapping.dmp
-
memory/1340-46-0x0000000000000000-mapping.dmp
-
memory/1340-48-0x0000000000000000-mapping.dmp
-
memory/1340-101-0x0000000000000000-mapping.dmp
-
memory/1340-99-0x0000000000000000-mapping.dmp
-
memory/1340-50-0x0000000000000000-mapping.dmp
-
memory/1340-97-0x0000000000000000-mapping.dmp
-
memory/1340-56-0x0000000004080000-0x0000000004081000-memory.dmpFilesize
4KB
-
memory/1340-61-0x0000000004080000-0x0000000004081000-memory.dmpFilesize
4KB
-
memory/1340-62-0x0000000004080000-0x0000000004081000-memory.dmpFilesize
4KB
-
memory/1340-229-0x0000000000000000-mapping.dmp
-
memory/1340-75-0x0000000000000000-mapping.dmp
-
memory/1340-76-0x0000000000000000-mapping.dmp
-
memory/1340-79-0x0000000000000000-mapping.dmp
-
memory/1340-81-0x0000000000000000-mapping.dmp
-
memory/1340-83-0x0000000000000000-mapping.dmp
-
memory/1340-85-0x0000000000000000-mapping.dmp
-
memory/1340-94-0x0000000000000000-mapping.dmp
-
memory/1340-228-0x0000000000000000-mapping.dmp
-
memory/1340-49-0x0000000000000000-mapping.dmp
-
memory/1340-227-0x0000000000000000-mapping.dmp
-
memory/1340-103-0x0000000000000000-mapping.dmp
-
memory/1340-108-0x0000000004080000-0x0000000004081000-memory.dmpFilesize
4KB
-
memory/1340-115-0x0000000004080000-0x00000000040A4000-memory.dmpFilesize
144KB
-
memory/1340-119-0x0000000006B90000-0x0000000006B91000-memory.dmpFilesize
4KB
-
memory/1340-125-0x0000000004460000-0x0000000004482000-memory.dmpFilesize
136KB
-
memory/1340-130-0x0000000007090000-0x0000000007091000-memory.dmpFilesize
4KB
-
memory/1340-134-0x0000000006A80000-0x0000000006A81000-memory.dmpFilesize
4KB
-
memory/1340-137-0x0000000006AC0000-0x0000000006AC1000-memory.dmpFilesize
4KB
-
memory/1340-150-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/1340-226-0x0000000000000000-mapping.dmp
-
memory/1340-225-0x0000000000000000-mapping.dmp
-
memory/1340-155-0x00000000077B0000-0x00000000077B1000-memory.dmpFilesize
4KB
-
memory/1340-163-0x0000000000000000-mapping.dmp
-
memory/1340-168-0x0000000000000000-mapping.dmp
-
memory/1340-164-0x0000000000000000-mapping.dmp
-
memory/1340-167-0x0000000000000000-mapping.dmp
-
memory/1340-166-0x0000000000000000-mapping.dmp
-
memory/1364-154-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/1364-151-0x0000000004600000-0x0000000004601000-memory.dmpFilesize
4KB
-
memory/2268-230-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/2268-241-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/2372-17-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/2372-14-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/2680-22-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2680-18-0x00000000043D0000-0x00000000043D1000-memory.dmpFilesize
4KB
-
memory/2680-21-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2696-156-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/3008-67-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/3468-160-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/3468-170-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/3712-2-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/3712-3-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/3712-5-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/3732-6-0x0000000003FD0000-0x0000000003FD1000-memory.dmpFilesize
4KB
-
memory/3732-9-0x0000000004680000-0x0000000004681000-memory.dmpFilesize
4KB
-
memory/3932-42-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3932-35-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/3932-34-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/4076-43-0x00000000041E0000-0x00000000041E1000-memory.dmpFilesize
4KB
-
memory/4076-52-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB