Analysis
- max time kernel
139s - max time network
141s - platform
windows10_x64 - resource
win10v20201028 - submitted
02/11/2020, 15:43
General
- Target fe525f5f789ba89ce5579cfdf60a0003.exe
- Size 667KB
- Sample201102-eqkrnhdpt6
- SHA256 0d3d30c7dbe44c4a06d291d8b13ef9940035eece68f2530d66dede28cb2955fe
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 8 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe525f5f789ba89ce5579cfdf60a0003.exe"C:\Users\Admin\AppData\Local\Temp\fe525f5f789ba89ce5579cfdf60a0003.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 8602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 12042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 15642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 16202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del ""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 15802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 18922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 16042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/184-43-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/184-40-0x00000000044B0000-0x00000000044B1000-memory.dmp
memory/388-28-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/388-27-0x0000000072D00000-0x00000000733EE000-memory.dmp
memory/588-39-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/588-36-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/804-5-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/804-3-0x00000000046C0000-0x00000000046C1000-memory.dmp
memory/804-2-0x00000000046C0000-0x00000000046C1000-memory.dmp
memory/1048-0-0x0000000002463000-0x0000000002464000-memory.dmp
memory/1048-1-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/2272-30-0x00000000044B0000-0x00000000044B1000-memory.dmp
memory/2272-35-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/2740-19-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/2740-16-0x0000000004620000-0x0000000004621000-memory.dmp
memory/3384-15-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/3384-10-0x00000000044B0000-0x00000000044B1000-memory.dmp
memory/3656-9-0x00000000049E0000-0x00000000049E1000-memory.dmp
memory/3656-6-0x00000000044B0000-0x00000000044B1000-memory.dmp
memory/3768-53-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/3768-46-0x0000000000400000-0x0000000000436000-memory.dmp
memory/3768-47-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/3768-48-0x0000000072D00000-0x00000000733EE000-memory.dmp
memory/3768-49-0x0000000002C20000-0x0000000002C44000-memory.dmp
memory/3768-50-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/3768-51-0x00000000053D0000-0x00000000053F2000-memory.dmp
memory/3768-52-0x00000000064C0000-0x00000000064C1000-memory.dmp
memory/3768-44-0x0000000000400000-0x0000000000436000-memory.dmp
memory/3768-54-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/3768-55-0x0000000005530000-0x0000000005531000-memory.dmp
memory/3768-56-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/3768-57-0x0000000006EA0000-0x0000000006EA1000-memory.dmp
memory/3768-58-0x00000000075A0000-0x00000000075A1000-memory.dmp
memory/3768-59-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
memory/3768-60-0x0000000007070000-0x0000000007071000-memory.dmp
memory/3768-61-0x00000000070F0000-0x00000000070F1000-memory.dmp
memory/3768-62-0x00000000073D0000-0x00000000073D1000-memory.dmp
memory/3768-63-0x00000000074F0000-0x0000000007500000-memory.dmp
memory/3768-65-0x0000000008CC0000-0x0000000008CC1000-memory.dmp
memory/3836-23-0x0000000005710000-0x0000000005711000-memory.dmp
memory/3836-20-0x0000000004EE0000-0x0000000004EE1000-memory.dmp