Analysis
-
max time kernel
121s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-11-2020 06:41
General
-
Target
9c2827e7f7a4c9a7c47e88f052c070b1.exe
-
Size
582KB
-
MD5
9c2827e7f7a4c9a7c47e88f052c070b1
-
SHA1
eb6d77adf05e13c95cce107d4e6e59df0a42f673
-
SHA256
d7857e0b29661872c17e025785d8ec9074f580f9837ba148699756fecf2b1779
-
SHA512
57f739684bae926ef6d0a90dc1db828a9917e12aa5b235d7a4f0780d62b86a631f4aa4eaeae0fa7e610eed0051aca806969987e7457e071a100b9e79fdc2e607
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 48 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c2827e7f7a4c9a7c47e88f052c070b1.exe"C:\Users\Admin\AppData\Local\Temp\9c2827e7f7a4c9a7c47e88f052c070b1.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 8562⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 12322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 15642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 16202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 5283⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 5323⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 12563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 12803⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 13163⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 15722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 18922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 16882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
memory/676-21-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/1356-79-0x0000000006970000-0x0000000006971000-memory.dmpFilesize
4KB
-
memory/1356-46-0x0000000000000000-mapping.dmp
-
memory/1356-208-0x0000000000000000-mapping.dmp
-
memory/1356-203-0x0000000000000000-mapping.dmp
-
memory/1356-25-0x0000000000000000-mapping.dmp
-
memory/1356-207-0x0000000000000000-mapping.dmp
-
memory/1356-206-0x0000000000000000-mapping.dmp
-
memory/1356-28-0x000000000250B000-0x000000000250C000-memory.dmpFilesize
4KB
-
memory/1356-29-0x00000000040F0000-0x00000000040F1000-memory.dmpFilesize
4KB
-
memory/1356-30-0x00000000044B0000-0x00000000044B1000-memory.dmpFilesize
4KB
-
memory/1356-32-0x00000000722C0000-0x00000000729AE000-memory.dmpFilesize
6.9MB
-
memory/1356-204-0x0000000000000000-mapping.dmp
-
memory/1356-205-0x0000000000000000-mapping.dmp
-
memory/1356-38-0x0000000000000000-mapping.dmp
-
memory/1356-39-0x0000000000000000-mapping.dmp
-
memory/1356-40-0x0000000000000000-mapping.dmp
-
memory/1356-41-0x0000000000000000-mapping.dmp
-
memory/1356-42-0x0000000000000000-mapping.dmp
-
memory/1356-202-0x0000000000000000-mapping.dmp
-
memory/1356-44-0x0000000000000000-mapping.dmp
-
memory/1356-45-0x0000000000000000-mapping.dmp
-
memory/1356-83-0x00000000069C0000-0x00000000069C1000-memory.dmpFilesize
4KB
-
memory/1356-47-0x0000000000000000-mapping.dmp
-
memory/1356-48-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/1356-50-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/1356-198-0x0000000000000000-mapping.dmp
-
memory/1356-52-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/1356-197-0x0000000000000000-mapping.dmp
-
memory/1356-196-0x0000000000000000-mapping.dmp
-
memory/1356-58-0x0000000000000000-mapping.dmp
-
memory/1356-59-0x0000000000000000-mapping.dmp
-
memory/1356-60-0x0000000000000000-mapping.dmp
-
memory/1356-61-0x0000000000000000-mapping.dmp
-
memory/1356-62-0x0000000000000000-mapping.dmp
-
memory/1356-195-0x0000000000000000-mapping.dmp
-
memory/1356-64-0x0000000000000000-mapping.dmp
-
memory/1356-66-0x0000000000000000-mapping.dmp
-
memory/1356-65-0x0000000000000000-mapping.dmp
-
memory/1356-67-0x0000000000000000-mapping.dmp
-
memory/1356-194-0x0000000000000000-mapping.dmp
-
memory/1356-193-0x0000000000000000-mapping.dmp
-
memory/1356-72-0x00000000041B0000-0x00000000041D4000-memory.dmpFilesize
144KB
-
memory/1356-73-0x0000000006A60000-0x0000000006A61000-memory.dmpFilesize
4KB
-
memory/1356-192-0x0000000000000000-mapping.dmp
-
memory/1356-75-0x0000000004250000-0x0000000004272000-memory.dmpFilesize
136KB
-
memory/1356-76-0x0000000006F60000-0x0000000006F61000-memory.dmpFilesize
4KB
-
memory/1356-77-0x0000000006930000-0x0000000006931000-memory.dmpFilesize
4KB
-
memory/1356-191-0x0000000000000000-mapping.dmp
-
memory/1356-68-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/1356-184-0x0000000000000000-mapping.dmp
-
memory/1356-181-0x0000000000000000-mapping.dmp
-
memory/1356-98-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/1356-179-0x0000000000000000-mapping.dmp
-
memory/1356-177-0x0000000000000000-mapping.dmp
-
memory/1356-175-0x0000000000000000-mapping.dmp
-
memory/1356-173-0x0000000000000000-mapping.dmp
-
memory/1356-126-0x0000000000000000-mapping.dmp
-
memory/1356-128-0x0000000000000000-mapping.dmp
-
memory/1356-132-0x0000000000000000-mapping.dmp
-
memory/1356-131-0x0000000000000000-mapping.dmp
-
memory/1356-137-0x0000000000000000-mapping.dmp
-
memory/1356-134-0x0000000000000000-mapping.dmp
-
memory/1356-171-0x0000000000000000-mapping.dmp
-
memory/1356-148-0x0000000000000000-mapping.dmp
-
memory/1356-146-0x0000000000000000-mapping.dmp
-
memory/1356-151-0x0000000000000000-mapping.dmp
-
memory/1356-153-0x0000000000000000-mapping.dmp
-
memory/1356-155-0x0000000000000000-mapping.dmp
-
memory/1356-170-0x0000000000000000-mapping.dmp
-
memory/1356-168-0x0000000000000000-mapping.dmp
-
memory/1716-43-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1716-36-0x00000000046E0000-0x00000000046E1000-memory.dmpFilesize
4KB
-
memory/1716-35-0x00000000046E0000-0x00000000046E1000-memory.dmpFilesize
4KB
-
memory/2280-49-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/2280-55-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/2536-162-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/2536-186-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/2572-63-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/2572-54-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/3084-69-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/3084-74-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/3200-17-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/3200-20-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/3568-78-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/3568-84-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/3844-9-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/3844-6-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/4052-209-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/4220-15-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/4220-10-0x00000000043B0000-0x00000000043B1000-memory.dmpFilesize
4KB
-
memory/4288-2-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/4288-5-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/4288-3-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/4716-117-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/4716-140-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/4760-1-0x00000000040D0000-0x00000000040D1000-memory.dmpFilesize
4KB
-
memory/4760-0-0x0000000002621000-0x0000000002622000-memory.dmpFilesize
4KB