Analysis
-
max time kernel
135s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-11-2020 06:32
General
-
Target
8f054f63dc9db8b44271b69ee32541db.exe
-
Size
559KB
-
MD5
8f054f63dc9db8b44271b69ee32541db
-
SHA1
abeb36520bd5b6d9d91a54029ae8a0bbfb4ec82a
-
SHA256
05797751460565ee0a402deabba76da1f83e0fb78d929499754d2a35a4bd8fb6
-
SHA512
127cc8250896c374eba6075cf65744b7686598ff91528f6d8ffed83a173db2c8d136d17cd31e2d4c6a9f99169ad7a2bf9163d4a27f62844ffb978248d574ced8
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 38 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f054f63dc9db8b44271b69ee32541db.exe"C:\Users\Admin\AppData\Local\Temp\8f054f63dc9db8b44271b69ee32541db.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 5323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 5123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 12283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 12723⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 12843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
C:\Users\Admin\AppData\Roaming\gfersesurity\bestof.exeMD5
651026d3f1f58ca2718cac5272a53192
SHA1f975cb02d4f348ae6cd3fd112b746445bd653e87
SHA256fdc884b306b56d605844a30990a565fed93cbbf6d15c04c524ee606fbb1d8931
SHA5129fe5bf0e4df06c0c67db69d6002366ee9897bdeb9c89940657f64852e9c287f1a2fc7ec2fac4377e77f97781045a4cc080318d2ec9e628da6ed9829a0ef929c3
-
memory/916-111-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/916-98-0x00000000041E0000-0x00000000041E1000-memory.dmpFilesize
4KB
-
memory/1192-0-0x000000000337C000-0x000000000337D000-memory.dmpFilesize
4KB
-
memory/1192-1-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/1620-89-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/1620-77-0x00000000040D0000-0x00000000040D1000-memory.dmpFilesize
4KB
-
memory/2784-63-0x0000000000000000-mapping.dmp
-
memory/2784-53-0x0000000006EB0000-0x0000000006ED2000-memory.dmpFilesize
136KB
-
memory/2784-2-0x0000000000000000-mapping.dmp
-
memory/2784-12-0x0000000000000000-mapping.dmp
-
memory/2784-14-0x0000000000000000-mapping.dmp
-
memory/2784-68-0x0000000000000000-mapping.dmp
-
memory/2784-15-0x0000000000000000-mapping.dmp
-
memory/2784-16-0x0000000000000000-mapping.dmp
-
memory/2784-17-0x0000000000000000-mapping.dmp
-
memory/2784-110-0x0000000000000000-mapping.dmp
-
memory/2784-20-0x0000000000000000-mapping.dmp
-
memory/2784-19-0x0000000000000000-mapping.dmp
-
memory/2784-21-0x0000000000000000-mapping.dmp
-
memory/2784-22-0x0000000000000000-mapping.dmp
-
memory/2784-23-0x0000000000000000-mapping.dmp
-
memory/2784-109-0x0000000000000000-mapping.dmp
-
memory/2784-27-0x0000000000000000-mapping.dmp
-
memory/2784-28-0x0000000000000000-mapping.dmp
-
memory/2784-30-0x0000000000000000-mapping.dmp
-
memory/2784-29-0x0000000000000000-mapping.dmp
-
memory/2784-31-0x0000000000000000-mapping.dmp
-
memory/2784-32-0x0000000000000000-mapping.dmp
-
memory/2784-108-0x0000000000000000-mapping.dmp
-
memory/2784-46-0x0000000000000000-mapping.dmp
-
memory/2784-47-0x0000000000000000-mapping.dmp
-
memory/2784-48-0x0000000000000000-mapping.dmp
-
memory/2784-49-0x0000000000000000-mapping.dmp
-
memory/2784-50-0x0000000000000000-mapping.dmp
-
memory/2784-51-0x0000000006930000-0x0000000006954000-memory.dmpFilesize
144KB
-
memory/2784-52-0x0000000006960000-0x0000000006961000-memory.dmpFilesize
4KB
-
memory/2784-67-0x0000000000000000-mapping.dmp
-
memory/2784-54-0x0000000006EE0000-0x0000000006EE1000-memory.dmpFilesize
4KB
-
memory/2784-55-0x0000000007590000-0x0000000007591000-memory.dmpFilesize
4KB
-
memory/2784-56-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/2784-57-0x0000000007620000-0x0000000007621000-memory.dmpFilesize
4KB
-
memory/2784-58-0x00000000077A0000-0x00000000077A1000-memory.dmpFilesize
4KB
-
memory/2784-107-0x0000000000000000-mapping.dmp
-
memory/2784-8-0x0000000072BB0000-0x000000007329E000-memory.dmpFilesize
6.9MB
-
memory/2784-62-0x0000000000000000-mapping.dmp
-
memory/2784-65-0x0000000000000000-mapping.dmp
-
memory/2784-83-0x0000000000000000-mapping.dmp
-
memory/2784-105-0x0000000000000000-mapping.dmp
-
memory/2784-13-0x0000000000000000-mapping.dmp
-
memory/2784-64-0x0000000000000000-mapping.dmp
-
memory/2784-101-0x0000000000000000-mapping.dmp
-
memory/2784-70-0x0000000000000000-mapping.dmp
-
memory/2784-72-0x0000000000000000-mapping.dmp
-
memory/2784-73-0x0000000000000000-mapping.dmp
-
memory/2784-71-0x0000000000000000-mapping.dmp
-
memory/2784-74-0x0000000000000000-mapping.dmp
-
memory/2784-75-0x0000000000000000-mapping.dmp
-
memory/2784-76-0x0000000000000000-mapping.dmp
-
memory/2784-7-0x0000000004120000-0x0000000004121000-memory.dmpFilesize
4KB
-
memory/2784-80-0x0000000000000000-mapping.dmp
-
memory/2784-82-0x0000000000000000-mapping.dmp
-
memory/2784-81-0x0000000000000000-mapping.dmp
-
memory/2784-66-0x0000000000000000-mapping.dmp
-
memory/2784-86-0x0000000000000000-mapping.dmp
-
memory/2784-85-0x0000000000000000-mapping.dmp
-
memory/2784-87-0x0000000000000000-mapping.dmp
-
memory/2784-88-0x0000000000000000-mapping.dmp
-
memory/2784-84-0x0000000000000000-mapping.dmp
-
memory/2784-6-0x0000000004120000-0x0000000004121000-memory.dmpFilesize
4KB
-
memory/2784-90-0x0000000000000000-mapping.dmp
-
memory/2784-94-0x0000000000000000-mapping.dmp
-
memory/2784-93-0x0000000000000000-mapping.dmp
-
memory/2784-92-0x0000000000000000-mapping.dmp
-
memory/2784-91-0x0000000000000000-mapping.dmp
-
memory/2784-97-0x0000000000000000-mapping.dmp
-
memory/2784-96-0x0000000000000000-mapping.dmp
-
memory/2784-95-0x0000000000000000-mapping.dmp
-
memory/2784-5-0x000000000249C000-0x000000000249D000-memory.dmpFilesize
4KB
-
memory/2784-102-0x0000000000000000-mapping.dmp
-
memory/2784-103-0x0000000000000000-mapping.dmp
-
memory/2784-106-0x0000000000000000-mapping.dmp
-
memory/2784-104-0x0000000000000000-mapping.dmp
-
memory/2808-34-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/2808-24-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3940-69-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/3940-59-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/3964-9-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/3964-18-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/3964-10-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB