Analysis
- max time kernel
142s - max time network
106s - platform
windows10_x64 - resource
win10v20201028 - submitted
03/11/2020, 13:34
General
- Target 35591c94270cd0b4d7049cf64c7fe287.exe
- Size 617KB
- Sample201103-rzhcbbmx4j
- SHA256 72258eed3286de7cbe53b978aae7675fb4b7c04130502375dce6e2b6debd2d08
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 45 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 13 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35591c94270cd0b4d7049cf64c7fe287.exe"C:\Users\Admin\AppData\Local\Temp\35591c94270cd0b4d7049cf64c7fe287.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 7562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 8602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 12122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 15682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 16082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 15442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 5363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 6923⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 10483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 10963⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 16962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 19362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 19602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/840-63-0x00000000044F0000-0x00000000044F1000-memory.dmp
memory/840-66-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/1184-70-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
memory/1184-67-0x00000000047A0000-0x00000000047A1000-memory.dmp
memory/1408-74-0x0000000005520000-0x0000000005521000-memory.dmp
memory/1408-71-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/1780-78-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
memory/1780-75-0x00000000045A0000-0x00000000045A1000-memory.dmp
memory/2144-79-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/2144-82-0x0000000005660000-0x0000000005661000-memory.dmp
memory/2512-167-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/2512-156-0x0000000004400000-0x0000000004401000-memory.dmp
memory/3076-139-0x00000000046E0000-0x00000000046E1000-memory.dmp
memory/3076-149-0x0000000005010000-0x0000000005011000-memory.dmp
memory/3668-86-0x0000000002547000-0x0000000002548000-memory.dmp
memory/3668-87-0x0000000002830000-0x0000000002831000-memory.dmp
memory/3668-88-0x0000000004270000-0x0000000004271000-memory.dmp
memory/3668-89-0x00000000722C0000-0x00000000729AE000-memory.dmp
memory/3668-104-0x00000000040C0000-0x00000000040E3000-memory.dmp
memory/3668-124-0x0000000006AA0000-0x0000000006AA1000-memory.dmp
memory/3668-125-0x0000000004370000-0x0000000004392000-memory.dmp
memory/3668-126-0x0000000006FA0000-0x0000000006FA1000-memory.dmp
memory/3668-128-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/3668-130-0x0000000004530000-0x0000000004531000-memory.dmp
memory/3668-132-0x0000000007620000-0x0000000007621000-memory.dmp
memory/3668-138-0x00000000077A0000-0x00000000077A1000-memory.dmp
memory/4016-116-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/4016-108-0x0000000004640000-0x0000000004641000-memory.dmp
memory/4076-91-0x00000000043E0000-0x00000000043E1000-memory.dmp
memory/4076-98-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/4076-90-0x00000000043E0000-0x00000000043E1000-memory.dmp
memory/4264-6-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/4264-3-0x0000000004970000-0x0000000004971000-memory.dmp
memory/4264-2-0x0000000004970000-0x0000000004971000-memory.dmp
memory/4280-134-0x0000000004190000-0x0000000004191000-memory.dmp
memory/4280-137-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/4536-105-0x00000000047C0000-0x00000000047C1000-memory.dmp
memory/4536-118-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/4704-127-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/4704-133-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/4756-0-0x0000000002529000-0x000000000252A000-memory.dmp
memory/4756-1-0x0000000002920000-0x0000000002921000-memory.dmp