Analysis
-
max time kernel
29s -
max time network
66s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-02-2021 19:06
General
-
Target
7aa21aecbdf633b2c535f267f4053f76.exe
-
Size
580KB
-
MD5
7aa21aecbdf633b2c535f267f4053f76
-
SHA1
4fc1081d614de271ede2e8f54b2149cc074b82c0
-
SHA256
41fc0071b14fa3a5990852af374922d234be8404ad0179e205d69b5e80613066
-
SHA512
b9689a74080b14179a81be09248bd81d1e1bd7c0f2e38cbd919f9b512988d2d2bbbeca47a2926acaabc222a8f8870cc1aa2a1f7de565b2dfb1e333b782b84af0
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aa21aecbdf633b2c535f267f4053f76.exe"C:\Users\Admin\AppData\Local\Temp\7aa21aecbdf633b2c535f267f4053f76.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fcontact\noabu.exenoabu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
4e622ee626caec7497e89442eeae4083
SHA139958ce2a0e9c43506a3b796ae7dd94e5317e430
SHA256c4b04c108c2308b1bb0558cf3de4fc2b1357a8c112d7bc38c228874000b8a4bd
SHA5120fbc24f6a3daef01e35dd63b3539b586f483aec8a79e02d8e17001869f73fcd6328787b241549a0ed40c6338b3fff35e6d6af4987699b114bfe59017f485fd88
-
MD5
4e622ee626caec7497e89442eeae4083
SHA139958ce2a0e9c43506a3b796ae7dd94e5317e430
SHA256c4b04c108c2308b1bb0558cf3de4fc2b1357a8c112d7bc38c228874000b8a4bd
SHA5120fbc24f6a3daef01e35dd63b3539b586f483aec8a79e02d8e17001869f73fcd6328787b241549a0ed40c6338b3fff35e6d6af4987699b114bfe59017f485fd88
-
Filesize
828KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
228KB
-
Filesize
6.9MB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB