Overview

overview

10

Static

static

23443_0998...DF.exe

windows7_x64

10

23443_0998...DF.exe

windows10_x64

10

Analysis

  • max time kernel
    45s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-12-2020 09:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23443_09986654_4556766_PDF.exe

  • Size

    469KB

  • MD5

    6b80e672407499b77dc38a13ddd0eb71

  • SHA1

    e42f4550a42bdf089e41d6576b1f800f47e92def

  • SHA256

    0eb70fd1476d81dcf01cef53f0cc4f6eb2718c86722eb8a08667f929a8254430

  • SHA512

    11b96ec30f61842bdcc712460f02b8b145723189ca028843b0b6f5dfc1b0deb61ada9510225393b069cf67d06d92857540397e1ce67175e6bb08f8bcb1ff0dca

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • Beds Protector Packer 1 IoCs

    Detects Beds Protector packer used to load .NET malware.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23443_09986654_4556766_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\23443_09986654_4556766_PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\23443_09986654_4556766_PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\23443_09986654_4556766_PDF.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\23443_09986654_4556766_PDF.exe"
        3⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • Runs ping.exe
          PID:328

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/328-14-0x0000000000000000-mapping.dmp

    Download

  • memory/1008-13-0x0000000000000000-mapping.dmp

    Download

  • memory/1636-6-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1636-7-0x0000000000420652-mapping.dmp

    Download

  • memory/1636-8-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1636-9-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1636-10-0x0000000074000000-0x00000000746EE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1668-2-0x0000000074000000-0x00000000746EE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1668-3-0x0000000000B40000-0x0000000000B41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1668-5-0x0000000000950000-0x000000000098B000-memory.dmp

    Filesize

    236KB

    Download