Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-11-2020 07:24
General
-
Target
aef69fb757dba463a759afb95ef12ce5.exe
-
Size
777KB
-
MD5
aef69fb757dba463a759afb95ef12ce5
-
SHA1
2d0c0e966d28cecc2b60eae9ea8eeb194153c923
-
SHA256
676f868c46ee3dd5106b23d5c5a8dc882348bbdc342519fb756fd28418b4a9e2
-
SHA512
27fe86cc65c1d40e7a4260432006d9016453ee60408c3cb949bf2ca89356fdf2417e75f1f2aa794f677591ec242b617c15fc83ae0814827f7f407457718c96d8
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 27 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef69fb757dba463a759afb95ef12ce5.exe"C:\Users\Admin\AppData\Local\Temp\aef69fb757dba463a759afb95ef12ce5.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 16082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 16602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 5363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 10203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 10283⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 17482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 19442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 18322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
memory/204-78-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/204-69-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/984-1-0x0000000004230000-0x0000000004231000-memory.dmpFilesize
4KB
-
memory/984-0-0x000000000240B000-0x000000000240D000-memory.dmpFilesize
8KB
-
memory/2100-106-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/2100-98-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/2112-42-0x0000000004210000-0x0000000004211000-memory.dmpFilesize
4KB
-
memory/2112-45-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/2192-75-0x0000000000000000-mapping.dmp
-
memory/2192-80-0x0000000000000000-mapping.dmp
-
memory/2192-180-0x0000000000000000-mapping.dmp
-
memory/2192-182-0x0000000000000000-mapping.dmp
-
memory/2192-46-0x0000000000000000-mapping.dmp
-
memory/2192-181-0x0000000000000000-mapping.dmp
-
memory/2192-179-0x0000000000000000-mapping.dmp
-
memory/2192-49-0x00000000026C4000-0x00000000026C5000-memory.dmpFilesize
4KB
-
memory/2192-50-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/2192-51-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/2192-52-0x0000000072960000-0x000000007304E000-memory.dmpFilesize
6.9MB
-
memory/2192-173-0x0000000000000000-mapping.dmp
-
memory/2192-176-0x0000000000000000-mapping.dmp
-
memory/2192-57-0x0000000000000000-mapping.dmp
-
memory/2192-58-0x0000000000000000-mapping.dmp
-
memory/2192-56-0x0000000000000000-mapping.dmp
-
memory/2192-59-0x0000000000000000-mapping.dmp
-
memory/2192-60-0x0000000000000000-mapping.dmp
-
memory/2192-177-0x0000000000000000-mapping.dmp
-
memory/2192-62-0x0000000000000000-mapping.dmp
-
memory/2192-63-0x0000000000000000-mapping.dmp
-
memory/2192-64-0x0000000000000000-mapping.dmp
-
memory/2192-65-0x0000000000000000-mapping.dmp
-
memory/2192-175-0x0000000000000000-mapping.dmp
-
memory/2192-174-0x0000000000000000-mapping.dmp
-
memory/2192-168-0x0000000000000000-mapping.dmp
-
memory/2192-73-0x0000000000000000-mapping.dmp
-
memory/2192-74-0x0000000000000000-mapping.dmp
-
memory/2192-169-0x0000000007750000-0x0000000007751000-memory.dmpFilesize
4KB
-
memory/2192-76-0x0000000000000000-mapping.dmp
-
memory/2192-77-0x0000000000000000-mapping.dmp
-
memory/2192-167-0x0000000000000000-mapping.dmp
-
memory/2192-79-0x0000000000000000-mapping.dmp
-
memory/2192-166-0x0000000000000000-mapping.dmp
-
memory/2192-81-0x0000000000000000-mapping.dmp
-
memory/2192-82-0x0000000000000000-mapping.dmp
-
memory/2192-104-0x0000000000000000-mapping.dmp
-
memory/2192-84-0x00000000041C0000-0x00000000041E4000-memory.dmpFilesize
144KB
-
memory/2192-87-0x0000000006940000-0x0000000006941000-memory.dmpFilesize
4KB
-
memory/2192-103-0x0000000000000000-mapping.dmp
-
memory/2192-89-0x0000000004480000-0x00000000044A2000-memory.dmpFilesize
136KB
-
memory/2192-90-0x0000000006E40000-0x0000000006E41000-memory.dmpFilesize
4KB
-
memory/2192-102-0x0000000000000000-mapping.dmp
-
memory/2192-93-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB
-
memory/2192-95-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/2192-101-0x0000000000000000-mapping.dmp
-
memory/2192-97-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/2208-41-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/2208-38-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/2284-12-0x0000000004210000-0x0000000004211000-memory.dmpFilesize
4KB
-
memory/2720-71-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/2720-66-0x0000000004210000-0x0000000004211000-memory.dmpFilesize
4KB
-
memory/3348-8-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/3348-11-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3676-4-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/3676-7-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/3676-5-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/3732-83-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/3732-88-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/3928-91-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/3928-96-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3936-170-0x0000000004560000-0x0000000004561000-memory.dmpFilesize
4KB
-
memory/3936-178-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/3976-53-0x0000000004210000-0x0000000004211000-memory.dmpFilesize
4KB
-
memory/3976-54-0x0000000004210000-0x0000000004211000-memory.dmpFilesize
4KB
-
memory/3976-61-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/4088-34-0x0000000004960000-0x0000000004961000-memory.dmpFilesize
4KB
-
memory/4088-37-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB