Analysis
-
max time kernel
118s -
max time network
65s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-11-2020 06:31
Static task
static1
Behavioral task
behavioral1
Sample
36e2f9c1e431033d5adb37b0dc81bf59.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
36e2f9c1e431033d5adb37b0dc81bf59.exe
Resource
win10v20201028
General
-
Target
36e2f9c1e431033d5adb37b0dc81bf59.exe
-
Size
591KB
-
MD5
36e2f9c1e431033d5adb37b0dc81bf59
-
SHA1
b031e56801f13ceaa555a9ae03ed68bd045e804d
-
SHA256
db7e0d16d32e7f115933695d419b903e24b14b7db4c347ab8380676c663edcb6
-
SHA512
909ce3030ee3a7c723e6465b0c42baa15c9e6e27ff8a05eb6d103f40b373d9b9a0926d988695ce7070671f7cebd57abb59a688562f54485cb947b3118988277c
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 39 IoCs
Processes:
resource yara_rule behavioral2/memory/3532-35-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-36-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-37-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-38-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-39-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-41-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-42-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-43-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-44-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-45-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-56-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-57-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-58-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-59-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-60-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-61-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-63-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-64-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-65-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-66-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-67-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-72-0x00000000041C0000-0x00000000041E4000-memory.dmp family_redline behavioral2/memory/3532-75-0x00000000069A0000-0x00000000069C2000-memory.dmp family_redline behavioral2/memory/3532-92-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-96-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-98-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-94-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-107-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-109-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-111-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-132-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-134-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-136-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-130-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-138-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-247-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-249-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-248-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/3532-250-0x0000000000000000-mapping.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
bestof.exepid process 3532 bestof.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3456 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 688 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 744 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 2120 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 1404 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 204 3532 WerFault.exe bestof.exe 412 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 2172 3532 WerFault.exe bestof.exe 1212 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 584 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 1056 1344 WerFault.exe 36e2f9c1e431033d5adb37b0dc81bf59.exe 2716 3532 WerFault.exe bestof.exe 1824 3532 WerFault.exe bestof.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
36e2f9c1e431033d5adb37b0dc81bf59.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 36e2f9c1e431033d5adb37b0dc81bf59.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 36e2f9c1e431033d5adb37b0dc81bf59.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 3456 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 688 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 744 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3456 WerFault.exe Token: SeBackupPrivilege 3456 WerFault.exe Token: SeDebugPrivilege 3456 WerFault.exe Token: SeDebugPrivilege 688 WerFault.exe Token: SeDebugPrivilege 744 WerFault.exe Token: SeDebugPrivilege 2120 WerFault.exe Token: SeDebugPrivilege 1404 WerFault.exe Token: SeDebugPrivilege 204 WerFault.exe Token: SeDebugPrivilege 412 WerFault.exe Token: SeDebugPrivilege 2172 WerFault.exe Token: SeDebugPrivilege 1212 WerFault.exe Token: SeDebugPrivilege 584 WerFault.exe Token: SeDebugPrivilege 1056 WerFault.exe Token: SeDebugPrivilege 2716 WerFault.exe Token: SeDebugPrivilege 1824 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
36e2f9c1e431033d5adb37b0dc81bf59.exedescription pid process target process PID 1344 wrote to memory of 3532 1344 36e2f9c1e431033d5adb37b0dc81bf59.exe bestof.exe PID 1344 wrote to memory of 3532 1344 36e2f9c1e431033d5adb37b0dc81bf59.exe bestof.exe PID 1344 wrote to memory of 3532 1344 36e2f9c1e431033d5adb37b0dc81bf59.exe bestof.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e2f9c1e431033d5adb37b0dc81bf59.exe"C:\Users\Admin\AppData\Local\Temp\36e2f9c1e431033d5adb37b0dc81bf59.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 7602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 12122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 15402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
PID:3532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 5363⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 5403⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 10003⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 10043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 16282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 19162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 19842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 15802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
memory/204-33-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/204-32-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/412-53-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/412-46-0x0000000004100000-0x0000000004101000-memory.dmpFilesize
4KB
-
memory/584-77-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/584-83-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/688-9-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/688-6-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/744-13-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/744-10-0x0000000004270000-0x0000000004271000-memory.dmpFilesize
4KB
-
memory/1056-95-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/1056-86-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/1212-74-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/1212-69-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/1344-1-0x0000000003AB0000-0x0000000003AB1000-memory.dmpFilesize
4KB
-
memory/1344-0-0x0000000001BE1000-0x0000000001BE3000-memory.dmpFilesize
8KB
-
memory/1404-21-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/1404-18-0x00000000045A0000-0x00000000045A1000-memory.dmpFilesize
4KB
-
memory/1824-143-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1824-120-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/2120-14-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/2120-17-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/2172-62-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/2172-52-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB
-
memory/2716-101-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/2716-89-0x00000000040E0000-0x00000000040E1000-memory.dmpFilesize
4KB
-
memory/3456-3-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3456-5-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/3456-2-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3532-29-0x0000000072670000-0x0000000072D5E000-memory.dmpFilesize
6.9MB
-
memory/3532-78-0x0000000007590000-0x0000000007591000-memory.dmpFilesize
4KB
-
memory/3532-45-0x0000000000000000-mapping.dmp
-
memory/3532-51-0x0000000004040000-0x0000000004041000-memory.dmpFilesize
4KB
-
memory/3532-50-0x0000000004040000-0x0000000004041000-memory.dmpFilesize
4KB
-
memory/3532-44-0x0000000000000000-mapping.dmp
-
memory/3532-43-0x0000000000000000-mapping.dmp
-
memory/3532-56-0x0000000000000000-mapping.dmp
-
memory/3532-57-0x0000000000000000-mapping.dmp
-
memory/3532-58-0x0000000000000000-mapping.dmp
-
memory/3532-59-0x0000000000000000-mapping.dmp
-
memory/3532-60-0x0000000000000000-mapping.dmp
-
memory/3532-61-0x0000000000000000-mapping.dmp
-
memory/3532-42-0x0000000000000000-mapping.dmp
-
memory/3532-63-0x0000000000000000-mapping.dmp
-
memory/3532-64-0x0000000000000000-mapping.dmp
-
memory/3532-65-0x0000000000000000-mapping.dmp
-
memory/3532-66-0x0000000000000000-mapping.dmp
-
memory/3532-67-0x0000000000000000-mapping.dmp
-
memory/3532-68-0x0000000004040000-0x0000000004041000-memory.dmpFilesize
4KB
-
memory/3532-41-0x0000000000000000-mapping.dmp
-
memory/3532-72-0x00000000041C0000-0x00000000041E4000-memory.dmpFilesize
144KB
-
memory/3532-73-0x0000000006A40000-0x0000000006A41000-memory.dmpFilesize
4KB
-
memory/3532-39-0x0000000000000000-mapping.dmp
-
memory/3532-75-0x00000000069A0000-0x00000000069C2000-memory.dmpFilesize
136KB
-
memory/3532-76-0x0000000006F40000-0x0000000006F41000-memory.dmpFilesize
4KB
-
memory/3532-38-0x0000000000000000-mapping.dmp
-
memory/3532-47-0x0000000004040000-0x0000000004041000-memory.dmpFilesize
4KB
-
memory/3532-81-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/3532-82-0x0000000007620000-0x0000000007621000-memory.dmpFilesize
4KB
-
memory/3532-37-0x0000000000000000-mapping.dmp
-
memory/3532-36-0x0000000000000000-mapping.dmp
-
memory/3532-35-0x0000000000000000-mapping.dmp
-
memory/3532-92-0x0000000000000000-mapping.dmp
-
memory/3532-27-0x0000000004200000-0x0000000004201000-memory.dmpFilesize
4KB
-
memory/3532-96-0x0000000000000000-mapping.dmp
-
memory/3532-98-0x0000000000000000-mapping.dmp
-
memory/3532-94-0x0000000000000000-mapping.dmp
-
memory/3532-26-0x0000000003FD0000-0x0000000003FD1000-memory.dmpFilesize
4KB
-
memory/3532-107-0x0000000000000000-mapping.dmp
-
memory/3532-109-0x0000000000000000-mapping.dmp
-
memory/3532-111-0x0000000000000000-mapping.dmp
-
memory/3532-25-0x00000000025FC000-0x00000000025FD000-memory.dmpFilesize
4KB
-
memory/3532-132-0x0000000000000000-mapping.dmp
-
memory/3532-134-0x0000000000000000-mapping.dmp
-
memory/3532-136-0x0000000000000000-mapping.dmp
-
memory/3532-130-0x0000000000000000-mapping.dmp
-
memory/3532-138-0x0000000000000000-mapping.dmp
-
memory/3532-22-0x0000000000000000-mapping.dmp
-
memory/3532-247-0x0000000000000000-mapping.dmp
-
memory/3532-249-0x0000000000000000-mapping.dmp
-
memory/3532-248-0x0000000000000000-mapping.dmp
-
memory/3532-250-0x0000000000000000-mapping.dmp
-
memory/3532-251-0x00000000078D0000-0x00000000078D1000-memory.dmpFilesize
4KB