Analysis
-
max time kernel
18s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-02-2021 19:14
Static task
static1
Behavioral task
behavioral1
Sample
d888d2ee464b54bd9cc94f3e9a8dba21.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
d888d2ee464b54bd9cc94f3e9a8dba21.exe
Resource
win10v20201028
General
-
Target
d888d2ee464b54bd9cc94f3e9a8dba21.exe
-
Size
655KB
-
MD5
d888d2ee464b54bd9cc94f3e9a8dba21
-
SHA1
f8a5049a84b0534cb446ee405cfd4efbed55d8e7
-
SHA256
cd31f1d60d83c4d03489059b88552f8f4d63e81af21ba4656b5637a638504708
-
SHA512
92b02eaa2c025b91fd330fba07ac45bed982ce3a1a79f5a486de0b885eb1fcfff3f393c6cd112ecb1caa3f37251292adb826412d654f72ce9fae20954babcf44
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3848-11-0x00000000023A0000-0x00000000023CE000-memory.dmp family_redline behavioral2/memory/3848-14-0x00000000024A0000-0x00000000024CC000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
noabu.exepid process 3848 noabu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
d888d2ee464b54bd9cc94f3e9a8dba21.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString d888d2ee464b54bd9cc94f3e9a8dba21.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d888d2ee464b54bd9cc94f3e9a8dba21.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
noabu.exepid process 3848 noabu.exe 3848 noabu.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
noabu.exedescription pid process Token: SeDebugPrivilege 3848 noabu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d888d2ee464b54bd9cc94f3e9a8dba21.exedescription pid process target process PID 4776 wrote to memory of 3848 4776 d888d2ee464b54bd9cc94f3e9a8dba21.exe noabu.exe PID 4776 wrote to memory of 3848 4776 d888d2ee464b54bd9cc94f3e9a8dba21.exe noabu.exe PID 4776 wrote to memory of 3848 4776 d888d2ee464b54bd9cc94f3e9a8dba21.exe noabu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d888d2ee464b54bd9cc94f3e9a8dba21.exe"C:\Users\Admin\AppData\Local\Temp\d888d2ee464b54bd9cc94f3e9a8dba21.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exenoabu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exeMD5
b193f6ad44a0e3a55782e365ad1b0082
SHA1a3187be12fe673b70640096db4a62a52923a5dbb
SHA2561ad35ecffd662312ffa048ae8b85344267ebdd6d5c3be375c99b84c57d3ef117
SHA51259722aafb85543225a17743cefaec55128813569cf898554ce8b9ef818a3eba564248184e656db4d7333a5923e6c5bed56da6eb6626ecc31a9d66dbb0b2a4820
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exeMD5
b193f6ad44a0e3a55782e365ad1b0082
SHA1a3187be12fe673b70640096db4a62a52923a5dbb
SHA2561ad35ecffd662312ffa048ae8b85344267ebdd6d5c3be375c99b84c57d3ef117
SHA51259722aafb85543225a17743cefaec55128813569cf898554ce8b9ef818a3eba564248184e656db4d7333a5923e6c5bed56da6eb6626ecc31a9d66dbb0b2a4820
-
memory/3848-16-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/3848-29-0x0000000006E10000-0x0000000006E11000-memory.dmpFilesize
4KB
-
memory/3848-30-0x0000000006EC0000-0x0000000006EC1000-memory.dmpFilesize
4KB
-
memory/3848-17-0x0000000002492000-0x0000000002493000-memory.dmpFilesize
4KB
-
memory/3848-8-0x0000000002110000-0x0000000002111000-memory.dmpFilesize
4KB
-
memory/3848-9-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/3848-10-0x0000000072480000-0x0000000072B6E000-memory.dmpFilesize
6.9MB
-
memory/3848-11-0x00000000023A0000-0x00000000023CE000-memory.dmpFilesize
184KB
-
memory/3848-12-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/3848-13-0x0000000002110000-0x0000000002147000-memory.dmpFilesize
220KB
-
memory/3848-14-0x00000000024A0000-0x00000000024CC000-memory.dmpFilesize
176KB
-
memory/3848-15-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3848-31-0x0000000007850000-0x0000000007851000-memory.dmpFilesize
4KB
-
memory/3848-5-0x0000000000000000-mapping.dmp
-
memory/3848-22-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/3848-19-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3848-20-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/3848-21-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/3848-18-0x0000000002493000-0x0000000002494000-memory.dmpFilesize
4KB
-
memory/3848-23-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/3848-24-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/3848-25-0x0000000002494000-0x0000000002496000-memory.dmpFilesize
8KB
-
memory/3848-26-0x0000000005A20000-0x0000000005A21000-memory.dmpFilesize
4KB
-
memory/3848-27-0x00000000065F0000-0x00000000065F1000-memory.dmpFilesize
4KB
-
memory/3848-28-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/4776-3-0x0000000002350000-0x000000000241F000-memory.dmpFilesize
828KB
-
memory/4776-4-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/4776-2-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB