Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-12-2020 21:34
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.PWSBanker.jc.23769.exe
-
Size
689KB
-
MD5
f0092d7c04e468c5b19773b672566637
-
SHA1
e9e5019301b5ece3d3d350f9be77cd07ff6e31c1
-
SHA256
e18183cba24914f1855b8e9f371bfe580b48a80fc99d8bcf69e1d8921c638384
-
SHA512
0e50480a883436ea888f9a97c25b769cfccfe559d41a4b9717c08c5ab603d255c07dc5d88e02e09c944cbd90f87e073c5ef73cd39bb08ea92fce01776649638c
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.PWSBanker.jc.23769.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.PWSBanker.jc.23769.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\leadentop\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a7e9e9cf220846cf4886665f5dca877d
SHA125316dff51b674a33b4db6aa4187477f1bcfb72f
SHA256f8c01a2d1b187aee1a6b8fc7cb87369cbc920e6c288f53af356287cb3def107e
SHA512b2922db7d114e27eda9d436bcd7bb7c29791fbee25a5807223dd9fc0f6b913b0caacbd0518ce97494f42a8bc2f44b0f33ec1cfb0144b41249589f64b23f266db
-
MD5
a7e9e9cf220846cf4886665f5dca877d
SHA125316dff51b674a33b4db6aa4187477f1bcfb72f
SHA256f8c01a2d1b187aee1a6b8fc7cb87369cbc920e6c288f53af356287cb3def107e
SHA512b2922db7d114e27eda9d436bcd7bb7c29791fbee25a5807223dd9fc0f6b913b0caacbd0518ce97494f42a8bc2f44b0f33ec1cfb0144b41249589f64b23f266db
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB