Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-11-2020 06:30
General
-
Target
fa178855e75da4e11abe52f74fd34e9a.exe
-
Size
559KB
-
MD5
fa178855e75da4e11abe52f74fd34e9a
-
SHA1
97ab1fb3f4e48a83c592359dd65c263d67a645a2
-
SHA256
dd215af644c53afeda830c1cadb562d615a40c3fdb4c541599c68acf3abb1e7c
-
SHA512
d70a2044fb77be5c5d9e2ea142ef3b94dde29330093729475c0552f5d31eebd9ce03c9b9731c58c237a46233d90a22d4597b545f39f2a19c0dde747902730255
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 43 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa178855e75da4e11abe52f74fd34e9a.exe"C:\Users\Admin\AppData\Local\Temp\fa178855e75da4e11abe52f74fd34e9a.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 5283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 5043⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 8403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 8203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
memory/1100-2-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1100-1-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1100-0-0x00000000030FC000-0x00000000030FD000-memory.dmpFilesize
4KB
-
memory/2276-37-0x0000000006A70000-0x0000000006A71000-memory.dmpFilesize
4KB
-
memory/2276-76-0x0000000000000000-mapping.dmp
-
memory/2276-7-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/2276-8-0x00000000043F0000-0x00000000043F1000-memory.dmpFilesize
4KB
-
memory/2276-9-0x0000000072BA0000-0x000000007328E000-memory.dmpFilesize
6.9MB
-
memory/2276-78-0x0000000007880000-0x0000000007881000-memory.dmpFilesize
4KB
-
memory/2276-72-0x0000000000000000-mapping.dmp
-
memory/2276-13-0x0000000000000000-mapping.dmp
-
memory/2276-14-0x0000000000000000-mapping.dmp
-
memory/2276-15-0x0000000000000000-mapping.dmp
-
memory/2276-40-0x00000000044F0000-0x00000000044F1000-memory.dmpFilesize
4KB
-
memory/2276-17-0x0000000000000000-mapping.dmp
-
memory/2276-38-0x0000000004340000-0x0000000004362000-memory.dmpFilesize
136KB
-
memory/2276-19-0x0000000000000000-mapping.dmp
-
memory/2276-20-0x0000000000000000-mapping.dmp
-
memory/2276-21-0x0000000000000000-mapping.dmp
-
memory/2276-22-0x0000000000000000-mapping.dmp
-
memory/2276-77-0x0000000000000000-mapping.dmp
-
memory/2276-26-0x0000000000000000-mapping.dmp
-
memory/2276-27-0x0000000000000000-mapping.dmp
-
memory/2276-28-0x0000000000000000-mapping.dmp
-
memory/2276-29-0x0000000000000000-mapping.dmp
-
memory/2276-30-0x0000000000000000-mapping.dmp
-
memory/2276-39-0x0000000006F70000-0x0000000006F71000-memory.dmpFilesize
4KB
-
memory/2276-32-0x0000000000000000-mapping.dmp
-
memory/2276-33-0x0000000000000000-mapping.dmp
-
memory/2276-34-0x0000000000000000-mapping.dmp
-
memory/2276-35-0x0000000000000000-mapping.dmp
-
memory/2276-36-0x00000000041A0000-0x00000000041C4000-memory.dmpFilesize
144KB
-
memory/2276-3-0x0000000000000000-mapping.dmp
-
memory/2276-75-0x0000000000000000-mapping.dmp
-
memory/2276-6-0x000000000251C000-0x000000000251D000-memory.dmpFilesize
4KB
-
memory/2276-16-0x0000000000000000-mapping.dmp
-
memory/2276-41-0x0000000004530000-0x0000000004531000-memory.dmpFilesize
4KB
-
memory/2276-73-0x0000000000000000-mapping.dmp
-
memory/2276-48-0x0000000000000000-mapping.dmp
-
memory/2276-47-0x0000000000000000-mapping.dmp
-
memory/2276-49-0x0000000000000000-mapping.dmp
-
memory/2276-50-0x0000000000000000-mapping.dmp
-
memory/2276-51-0x0000000000000000-mapping.dmp
-
memory/2276-52-0x0000000000000000-mapping.dmp
-
memory/2276-54-0x0000000000000000-mapping.dmp
-
memory/2276-55-0x0000000000000000-mapping.dmp
-
memory/2276-56-0x0000000000000000-mapping.dmp
-
memory/2276-57-0x0000000000000000-mapping.dmp
-
memory/2276-58-0x0000000000000000-mapping.dmp
-
memory/2276-59-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/2276-60-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/2276-74-0x0000000000000000-mapping.dmp
-
memory/2276-65-0x0000000000000000-mapping.dmp
-
memory/2276-66-0x0000000000000000-mapping.dmp
-
memory/2276-67-0x0000000000000000-mapping.dmp
-
memory/2276-64-0x0000000000000000-mapping.dmp
-
memory/2276-70-0x0000000000000000-mapping.dmp
-
memory/2276-69-0x0000000000000000-mapping.dmp
-
memory/2276-68-0x0000000000000000-mapping.dmp
-
memory/2816-44-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/3696-18-0x00000000048A0000-0x00000000048A1000-memory.dmpFilesize
4KB
-
memory/3696-11-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/3696-10-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/3700-71-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/3700-61-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/4056-31-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/4056-23-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB