Analysis
- max time kernel
21s - max time network
117s - platform
windows10_x64 - resource
win10v20201028 - submitted
02/11/2020, 15:39
General
- Target 093b8032a7268c0f9b031bea1fa0e071.exe
- Size 618KB
- Sample201102-7tkr8ztk2s
- SHA256 907e9ddd53b5ea82eabb585907c74a96fba6b4a2e7d744407d404f76b399c3dc
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 9 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\093b8032a7268c0f9b031bea1fa0e071.exe"C:\Users\Admin\AppData\Local\Temp\093b8032a7268c0f9b031bea1fa0e071.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 8802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 12282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del ""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 16202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 19082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 16122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 16842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/60-158-0x0000000006920000-0x0000000006921000-memory.dmp
memory/60-55-0x0000000004D30000-0x0000000004D52000-memory.dmp
memory/60-63-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/60-160-0x00000000073B0000-0x00000000073B1000-memory.dmp
memory/60-159-0x0000000006A60000-0x0000000006A61000-memory.dmp
memory/60-61-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/60-157-0x00000000069C0000-0x00000000069C1000-memory.dmp
memory/60-59-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/60-56-0x0000000005E70000-0x0000000005E71000-memory.dmp
memory/60-156-0x0000000006E50000-0x0000000006E51000-memory.dmp
memory/60-155-0x0000000006750000-0x0000000006751000-memory.dmp
memory/60-161-0x0000000008370000-0x0000000008371000-memory.dmp
memory/60-71-0x0000000005130000-0x0000000005131000-memory.dmp
memory/60-54-0x0000000005360000-0x0000000005361000-memory.dmp
memory/60-52-0x0000000072490000-0x0000000072B7E000-memory.dmp
memory/60-53-0x0000000002830000-0x0000000002854000-memory.dmp
memory/60-50-0x0000000000400000-0x0000000000436000-memory.dmp
memory/60-51-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/60-48-0x0000000000400000-0x0000000000436000-memory.dmp
memory/440-4-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/440-3-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/440-6-0x0000000004800000-0x0000000004801000-memory.dmp
memory/1260-57-0x00000000042B0000-0x00000000042B1000-memory.dmp
memory/1260-62-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/1464-67-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/1464-64-0x00000000044B0000-0x00000000044B1000-memory.dmp
memory/1664-18-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/1664-15-0x0000000004510000-0x0000000004511000-memory.dmp
memory/1684-68-0x0000000004840000-0x0000000004841000-memory.dmp
memory/1684-73-0x0000000005070000-0x0000000005071000-memory.dmp
memory/3912-14-0x0000000005800000-0x0000000005801000-memory.dmp
memory/3912-11-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/4068-19-0x0000000004190000-0x0000000004191000-memory.dmp
memory/4152-10-0x0000000004930000-0x0000000004931000-memory.dmp
memory/4152-7-0x0000000004280000-0x0000000004281000-memory.dmp
memory/4500-151-0x0000000004270000-0x0000000004271000-memory.dmp
memory/4600-46-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/4600-45-0x0000000072490000-0x0000000072B7E000-memory.dmp
memory/4768-1-0x0000000002980000-0x0000000002981000-memory.dmp
memory/4768-0-0x0000000002589000-0x000000000258A000-memory.dmp