Analysis
- max time kernel
144s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/12/2020, 07:51
General
- Target cf9789f166db5c71af1b66f9b6ace520.exe
- Size 595KB
- Sample201228-gh92kl823e
- SHA256 4eb5508fd5f2e2e2c78f406c2312dd83d7790d3822cb2182fbb86df85afd6777
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf9789f166db5c71af1b66f9b6ace520.exe"C:\Users\Admin\AppData\Local\Temp\cf9789f166db5c71af1b66f9b6ace520.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\leadentop\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1316-3-0x0000000005320000-0x0000000005321000-memory.dmp
memory/1316-2-0x000000000500B000-0x000000000500C000-memory.dmp
memory/1984-10-0x0000000072D70000-0x000000007345E000-memory.dmp
memory/1984-7-0x0000000004E07000-0x0000000004E08000-memory.dmp
memory/1984-8-0x0000000005360000-0x0000000005361000-memory.dmp
memory/1984-9-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
memory/1984-11-0x0000000006C60000-0x0000000006C84000-memory.dmp
memory/1984-12-0x00000000095D0000-0x00000000095D1000-memory.dmp
memory/1984-13-0x0000000009440000-0x0000000009462000-memory.dmp
memory/1984-14-0x0000000009AD0000-0x0000000009AD1000-memory.dmp
memory/1984-15-0x0000000009500000-0x0000000009501000-memory.dmp
memory/1984-16-0x0000000009540000-0x0000000009541000-memory.dmp
memory/1984-17-0x000000000A0E0000-0x000000000A0E1000-memory.dmp
memory/1984-18-0x000000000A230000-0x000000000A231000-memory.dmp