Analysis
- max time kernel
135s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
03/11/2020, 13:37
General
- Target 026de3494e6213658ddde0b7818ca8f5.exe
- Size 631KB
- Sample201103-he9csqs96e
- SHA256 2f1ddb2471b5361788e5f3366513f69b03d605bc609beea401f6864cd70ca0ff
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 47 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 16 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\026de3494e6213658ddde0b7818ca8f5.exe"C:\Users\Admin\AppData\Local\Temp\026de3494e6213658ddde0b7818ca8f5.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 15842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 15282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 5363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 10123⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 10203⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 12443⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 12723⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 13323⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 16282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 19162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 18122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-106-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/640-96-0x0000000004400000-0x0000000004401000-memory.dmp
memory/1004-50-0x0000000004530000-0x0000000004531000-memory.dmp
memory/1004-60-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/1092-21-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/1092-18-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/1244-66-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/1568-33-0x0000000004010000-0x0000000004011000-memory.dmp
memory/1568-41-0x00000000047C0000-0x00000000047C1000-memory.dmp
memory/1568-34-0x0000000004010000-0x0000000004011000-memory.dmp
memory/1912-80-0x0000000005760000-0x0000000005761000-memory.dmp
memory/1912-76-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/2224-13-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/2224-10-0x0000000004270000-0x0000000004271000-memory.dmp
memory/2356-5-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/2356-3-0x00000000045B0000-0x00000000045B1000-memory.dmp
memory/2356-2-0x00000000045B0000-0x00000000045B1000-memory.dmp
memory/2500-30-0x0000000002870000-0x0000000002871000-memory.dmp
memory/2500-29-0x00000000024E7000-0x00000000024E8000-memory.dmp
memory/2500-32-0x0000000072A00000-0x00000000730EE000-memory.dmp
memory/2500-69-0x0000000004100000-0x0000000004123000-memory.dmp
memory/2500-70-0x0000000006A90000-0x0000000006A91000-memory.dmp
memory/2500-71-0x00000000041B0000-0x00000000041D2000-memory.dmp
memory/2500-72-0x0000000006F90000-0x0000000006F91000-memory.dmp
memory/2500-74-0x00000000075A0000-0x00000000075A1000-memory.dmp
memory/2500-75-0x00000000075E0000-0x00000000075E1000-memory.dmp
memory/2500-79-0x0000000007620000-0x0000000007621000-memory.dmp
memory/2500-113-0x0000000007930000-0x0000000007931000-memory.dmp
memory/2500-31-0x00000000041F0000-0x00000000041F1000-memory.dmp
memory/2524-25-0x0000000005340000-0x0000000005341000-memory.dmp
memory/2524-22-0x0000000004B10000-0x0000000004B11000-memory.dmp
memory/2708-167-0x0000000005470000-0x0000000005471000-memory.dmp
memory/2708-154-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/2924-191-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/2924-177-0x0000000004690000-0x0000000004691000-memory.dmp
memory/3472-145-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/3472-133-0x00000000043F0000-0x00000000043F1000-memory.dmp
memory/3492-6-0x0000000004270000-0x0000000004271000-memory.dmp
memory/3492-9-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/3552-125-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/3552-114-0x00000000047F0000-0x00000000047F1000-memory.dmp
memory/3708-52-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/3708-47-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/3868-81-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/3868-90-0x0000000005610000-0x0000000005611000-memory.dmp
memory/3920-14-0x0000000004820000-0x0000000004821000-memory.dmp
memory/3920-17-0x0000000005150000-0x0000000005151000-memory.dmp
memory/3988-1-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/3988-0-0x0000000002529000-0x000000000252A000-memory.dmp