Analysis
-
max time kernel
137s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-11-2020 07:31
General
-
Target
fa4988669374b7f32ab387fe8029625e.exe
-
Size
778KB
-
MD5
fa4988669374b7f32ab387fe8029625e
-
SHA1
982be59b08cbaae6aeddbc32ae55989ac551a917
-
SHA256
951d7b367ca9c6742c6c48a017519323a9ee9b7c3ec0fed414aabcd5fc09c26f
-
SHA512
68c329f9c888a9034a6f4be638b7d1bff5fda2167898f3d7526089c589b68a1e535c91e57a24af6fe0cc2911243ec188a2e370e54e45b85ecb3a0fed413bea1e
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 30 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa4988669374b7f32ab387fe8029625e.exe"C:\Users\Admin\AppData\Local\Temp\fa4988669374b7f32ab387fe8029625e.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 8682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 15362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 7043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 10083⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 10123⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 16082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 18962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 18122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
memory/196-24-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/196-19-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/540-15-0x0000000004640000-0x0000000004641000-memory.dmpFilesize
4KB
-
memory/540-1-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/540-0-0x00000000025B6000-0x00000000025B8000-memory.dmpFilesize
8KB
-
memory/540-10-0x0000000004350000-0x0000000004351000-memory.dmpFilesize
4KB
-
memory/936-28-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/936-25-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/1464-112-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/1464-104-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/2344-41-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/2344-40-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/2344-48-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/2692-81-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/2692-73-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/2828-100-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/2828-93-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/2904-14-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/2904-11-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/3176-50-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/3176-57-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/3292-32-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/3292-29-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3432-67-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/3432-58-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/3556-9-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/3556-7-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/3556-6-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/4012-63-0x0000000000000000-mapping.dmp
-
memory/4012-82-0x00000000070A0000-0x00000000070A1000-memory.dmpFilesize
4KB
-
memory/4012-51-0x0000000000000000-mapping.dmp
-
memory/4012-54-0x0000000000000000-mapping.dmp
-
memory/4012-55-0x0000000000000000-mapping.dmp
-
memory/4012-56-0x0000000000000000-mapping.dmp
-
memory/4012-47-0x0000000000000000-mapping.dmp
-
memory/4012-46-0x0000000000000000-mapping.dmp
-
memory/4012-62-0x0000000000000000-mapping.dmp
-
memory/4012-61-0x0000000000000000-mapping.dmp
-
memory/4012-45-0x0000000000000000-mapping.dmp
-
memory/4012-65-0x0000000000000000-mapping.dmp
-
memory/4012-64-0x0000000000000000-mapping.dmp
-
memory/4012-66-0x0000000000000000-mapping.dmp
-
memory/4012-44-0x0000000000000000-mapping.dmp
-
memory/4012-68-0x0000000000000000-mapping.dmp
-
memory/4012-69-0x0000000000000000-mapping.dmp
-
memory/4012-72-0x0000000000000000-mapping.dmp
-
memory/4012-71-0x0000000000000000-mapping.dmp
-
memory/4012-43-0x0000000000000000-mapping.dmp
-
memory/4012-70-0x0000000000000000-mapping.dmp
-
memory/4012-78-0x0000000004080000-0x00000000040A4000-memory.dmpFilesize
144KB
-
memory/4012-79-0x0000000006BA0000-0x0000000006BA1000-memory.dmpFilesize
4KB
-
memory/4012-80-0x00000000043A0000-0x00000000043C2000-memory.dmpFilesize
136KB
-
memory/4012-39-0x0000000072640000-0x0000000072D2E000-memory.dmpFilesize
6.9MB
-
memory/4012-49-0x0000000000000000-mapping.dmp
-
memory/4012-83-0x0000000006A80000-0x0000000006A81000-memory.dmpFilesize
4KB
-
memory/4012-84-0x0000000006AC0000-0x0000000006AC1000-memory.dmpFilesize
4KB
-
memory/4012-118-0x0000000000000000-mapping.dmp
-
memory/4012-117-0x0000000000000000-mapping.dmp
-
memory/4012-92-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/4012-38-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/4012-97-0x0000000000000000-mapping.dmp
-
memory/4012-96-0x0000000000000000-mapping.dmp
-
memory/4012-98-0x0000000000000000-mapping.dmp
-
memory/4012-99-0x0000000000000000-mapping.dmp
-
memory/4012-37-0x00000000040C0000-0x00000000040C1000-memory.dmpFilesize
4KB
-
memory/4012-101-0x0000000000000000-mapping.dmp
-
memory/4012-103-0x0000000000000000-mapping.dmp
-
memory/4012-102-0x0000000000000000-mapping.dmp
-
memory/4012-36-0x0000000002534000-0x0000000002535000-memory.dmpFilesize
4KB
-
memory/4012-107-0x0000000000000000-mapping.dmp
-
memory/4012-108-0x0000000000000000-mapping.dmp
-
memory/4012-110-0x0000000000000000-mapping.dmp
-
memory/4012-111-0x0000000000000000-mapping.dmp
-
memory/4012-109-0x0000000000000000-mapping.dmp
-
memory/4012-33-0x0000000000000000-mapping.dmp
-
memory/4012-115-0x0000000000000000-mapping.dmp
-
memory/4012-116-0x0000000000000000-mapping.dmp
-
memory/4084-90-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/4084-85-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB