Analysis
-
max time kernel
34s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
02-12-2020 08:45
General
-
Target
975ddb42a7507832e8a8c458054f4285.exe
-
Size
551KB
-
MD5
975ddb42a7507832e8a8c458054f4285
-
SHA1
15c4ac9e60d4aa8355d255bb19ef3dca1148606f
-
SHA256
d94a672fd4dc3fd14b52c67d37822efd114ed1bbecc49633bbf74509843380a1
-
SHA512
e1def37cfd4277e741726f92766cd95a526bcb2ae144839cf2343a22d255e3b402419a978d67d957996326092a47cbb55614c3ec088f5566a628a362f57b0536
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\975ddb42a7507832e8a8c458054f4285.exe"C:\Users\Admin\AppData\Local\Temp\975ddb42a7507832e8a8c458054f4285.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gfersesurityd\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
bd0bcda992939e8c117e758e8ebffc93
SHA160f5ccb2f8f7859c0a580041d651fe2e6cd1edbe
SHA256a3948163bc436fde2808c4c76fccc90d515f3d754fc5851f0eb1e8b40a539e2b
SHA5121c81bfed10ee288fbb6f8a877ce3f7d64407cfd547e1be02d5789d0a528800ff8fa2fc3f280171a377daa5f013286bb7fb1e13b2cd4261caf2892462cf057f36
-
MD5
bd0bcda992939e8c117e758e8ebffc93
SHA160f5ccb2f8f7859c0a580041d651fe2e6cd1edbe
SHA256a3948163bc436fde2808c4c76fccc90d515f3d754fc5851f0eb1e8b40a539e2b
SHA5121c81bfed10ee288fbb6f8a877ce3f7d64407cfd547e1be02d5789d0a528800ff8fa2fc3f280171a377daa5f013286bb7fb1e13b2cd4261caf2892462cf057f36
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
148KB
-
Filesize
4KB
-
Filesize
140KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB