Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 08:10
General
-
Target
2925b0ded3481c8d591953f51fc2bdf6.exe
-
Size
1.6MB
-
MD5
2925b0ded3481c8d591953f51fc2bdf6
-
SHA1
c908771ddd4e98d2e529435ed8088278bb0fd8c6
-
SHA256
cd0877c4520b3696db9393de1565caf3844f26b588244dd4bb38b149f46d3400
-
SHA512
76c334152fb722b12e6e66a76040fd1a0fcbcb4703d08435cf22d4833352df1d38c3c9ebcc69dcc759baf235c2c5c364cf5789f0b69c93a00ae55081ede5b68b
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2925b0ded3481c8d591953f51fc2bdf6.exe"C:\Users\Admin\AppData\Local\Temp\2925b0ded3481c8d591953f51fc2bdf6.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gferrfghvbc\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
70b591a72fd31527c9c89e36625cefe9
SHA1423fe658bc2d65ba595c460177438bf94f9b4edf
SHA256807ba89d095a8f641a35ed199f2a72404b61000f5d08764ee9f4b24cbc47623b
SHA512eab5e07c07185f6aeca04dead288fcd55844e88cf8b8e079a5bf0c6a210ab2601c12cdd0f724c2e091fe7a2340f3d97b774acf305ae2a99d5444aa9ae1db8071
-
MD5
70b591a72fd31527c9c89e36625cefe9
SHA1423fe658bc2d65ba595c460177438bf94f9b4edf
SHA256807ba89d095a8f641a35ed199f2a72404b61000f5d08764ee9f4b24cbc47623b
SHA512eab5e07c07185f6aeca04dead288fcd55844e88cf8b8e079a5bf0c6a210ab2601c12cdd0f724c2e091fe7a2340f3d97b774acf305ae2a99d5444aa9ae1db8071
-
Filesize
6.9MB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB