Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-11-2020 06:51
General
-
Target
f46d787e2481635ba7b407ec6332d0e1.exe
-
Size
781KB
-
MD5
f46d787e2481635ba7b407ec6332d0e1
-
SHA1
24147480bba1cabc3c214e5d84ec70b59c85e615
-
SHA256
08b695d45d297aea56ccc80bef7613eae070498512805243db8e4b887d2b2c8c
-
SHA512
c857462a86a3d78afa51fead3c8be14057ff0885ef78da04664f4a6be394b8de2951591fc1177d2649d54b78d530b480051d321e26d68556f2965b14b492eef8
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 36 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f46d787e2481635ba7b407ec6332d0e1.exe"C:\Users\Admin\AppData\Local\Temp\f46d787e2481635ba7b407ec6332d0e1.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 12202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 15802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 5203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 10203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 10323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 16682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 19042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 18162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
6943b3380427465a7998ddf3a96945a0
SHA1abb680ef5e005da1610828d518c15a250b001fd9
SHA25694e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
SHA5125c8fb35986df56b3f6f7b850a98455ab3d767372b57838d54c9faf280826975a0f2a0828fa977469a3d5e02ce9f7bea23e8b574cf793f4264f385e871de8277d
-
memory/636-6-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/636-9-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/648-1-0x00000000041B0000-0x00000000041B1000-memory.dmpFilesize
4KB
-
memory/648-0-0x0000000002626000-0x0000000002628000-memory.dmpFilesize
8KB
-
memory/728-38-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/728-30-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/728-29-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/1852-77-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/1852-74-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/1908-52-0x0000000000000000-mapping.dmp
-
memory/1908-58-0x0000000000000000-mapping.dmp
-
memory/1908-22-0x0000000000000000-mapping.dmp
-
memory/1908-96-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1908-91-0x0000000000000000-mapping.dmp
-
memory/1908-25-0x0000000002384000-0x0000000002385000-memory.dmpFilesize
4KB
-
memory/1908-26-0x0000000003F20000-0x0000000003F21000-memory.dmpFilesize
4KB
-
memory/1908-27-0x00000000043E0000-0x00000000043E1000-memory.dmpFilesize
4KB
-
memory/1908-28-0x0000000072200000-0x00000000728EE000-memory.dmpFilesize
6.9MB
-
memory/1908-95-0x0000000000000000-mapping.dmp
-
memory/1908-94-0x0000000000000000-mapping.dmp
-
memory/1908-33-0x0000000000000000-mapping.dmp
-
memory/1908-32-0x0000000000000000-mapping.dmp
-
memory/1908-34-0x0000000000000000-mapping.dmp
-
memory/1908-35-0x0000000000000000-mapping.dmp
-
memory/1908-36-0x0000000000000000-mapping.dmp
-
memory/1908-93-0x0000000000000000-mapping.dmp
-
memory/1908-37-0x0000000000000000-mapping.dmp
-
memory/1908-39-0x0000000000000000-mapping.dmp
-
memory/1908-40-0x0000000000000000-mapping.dmp
-
memory/1908-41-0x0000000000000000-mapping.dmp
-
memory/1908-42-0x0000000000000000-mapping.dmp
-
memory/1908-43-0x0000000000000000-mapping.dmp
-
memory/1908-92-0x0000000000000000-mapping.dmp
-
memory/1908-90-0x0000000000000000-mapping.dmp
-
memory/1908-88-0x0000000000000000-mapping.dmp
-
memory/1908-51-0x0000000000000000-mapping.dmp
-
memory/1908-87-0x0000000000000000-mapping.dmp
-
memory/1908-53-0x0000000000000000-mapping.dmp
-
memory/1908-54-0x0000000000000000-mapping.dmp
-
memory/1908-55-0x0000000000000000-mapping.dmp
-
memory/1908-56-0x0000000000000000-mapping.dmp
-
memory/1908-86-0x0000000000000000-mapping.dmp
-
memory/1908-59-0x0000000000000000-mapping.dmp
-
memory/1908-85-0x0000000000000000-mapping.dmp
-
memory/1908-60-0x0000000000000000-mapping.dmp
-
memory/1908-61-0x0000000000000000-mapping.dmp
-
memory/1908-62-0x0000000000000000-mapping.dmp
-
memory/1908-84-0x0000000000000000-mapping.dmp
-
memory/1908-64-0x0000000004510000-0x0000000004534000-memory.dmpFilesize
144KB
-
memory/1908-83-0x0000000000000000-mapping.dmp
-
memory/1908-68-0x0000000006A20000-0x0000000006A21000-memory.dmpFilesize
4KB
-
memory/1908-82-0x0000000000000000-mapping.dmp
-
memory/1908-70-0x0000000004580000-0x00000000045A2000-memory.dmpFilesize
136KB
-
memory/1908-71-0x0000000006F20000-0x0000000006F21000-memory.dmpFilesize
4KB
-
memory/1908-72-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/1908-73-0x00000000075E0000-0x00000000075E1000-memory.dmpFilesize
4KB
-
memory/1908-78-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/2136-50-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/2136-44-0x0000000004560000-0x0000000004561000-memory.dmpFilesize
4KB
-
memory/2336-67-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2336-63-0x00000000043D0000-0x00000000043D1000-memory.dmpFilesize
4KB
-
memory/2336-69-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2512-97-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/2840-10-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/2840-13-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/3140-17-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/3140-14-0x0000000004410000-0x0000000004411000-memory.dmpFilesize
4KB
-
memory/3604-21-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/3604-18-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/3768-57-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/3768-47-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/3836-89-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/3836-79-0x0000000004650000-0x0000000004651000-memory.dmpFilesize
4KB
-
memory/3984-3-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/3984-5-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/3984-2-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB