Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/12/2020, 17:05
General
- Target da0baba4a78ada89b12bb09154ce8845.exe
- Size 594KB
- Sample201228-pygjayv3ts
- SHA256 c96f35457cc26c36104f053cb445c0835ead6434c3ce57adaae7911b2ab51d5c
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da0baba4a78ada89b12bb09154ce8845.exe"C:\Users\Admin\AppData\Local\Temp\da0baba4a78ada89b12bb09154ce8845.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\leadentop\bestof.exebestof.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/744-3-0x0000000005730000-0x0000000005731000-memory.dmp
memory/744-2-0x000000000518B000-0x000000000518C000-memory.dmp
memory/3952-10-0x0000000072B40000-0x000000007322E000-memory.dmp
memory/3952-7-0x0000000004FE7000-0x0000000004FE8000-memory.dmp
memory/3952-8-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/3952-9-0x0000000006D50000-0x0000000006D51000-memory.dmp
memory/3952-11-0x0000000006D00000-0x0000000006D24000-memory.dmp
memory/3952-12-0x00000000094C0000-0x00000000094C1000-memory.dmp
memory/3952-13-0x0000000006EC0000-0x0000000006EE2000-memory.dmp
memory/3952-14-0x00000000099C0000-0x00000000099C1000-memory.dmp
memory/3952-15-0x00000000093C0000-0x00000000093C1000-memory.dmp
memory/3952-16-0x0000000009400000-0x0000000009401000-memory.dmp
memory/3952-17-0x0000000009450000-0x0000000009451000-memory.dmp
memory/3952-18-0x000000000A0F0000-0x000000000A0F1000-memory.dmp