Analysis
-
max time kernel
18s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-02-2021 19:16
Static task
static1
Behavioral task
behavioral1
Sample
6257af2ce3336b7fa6debe8614c9ab81.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
6257af2ce3336b7fa6debe8614c9ab81.exe
Resource
win10v20201028
General
-
Target
6257af2ce3336b7fa6debe8614c9ab81.exe
-
Size
655KB
-
MD5
6257af2ce3336b7fa6debe8614c9ab81
-
SHA1
0eed0a8362f934887b3dd05bdc4498c5576a1216
-
SHA256
4b6db0ab009cf8babc3d2f5390b8dba1ae7367c24cb0988dd96d04a4b25a2b4a
-
SHA512
57edde7c5ff6ac7a90372270a164d5805f78804238dfb253d9d13624115904f1aeffe09f65bbb527920ff4375fad5952a19c08aaf907f3c4ad8e8adbf090dee5
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2628-14-0x00000000021E0000-0x000000000220E000-memory.dmp family_redline behavioral2/memory/2628-16-0x0000000004B40000-0x0000000004B6C000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
noabu.exepid process 2628 noabu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6257af2ce3336b7fa6debe8614c9ab81.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6257af2ce3336b7fa6debe8614c9ab81.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6257af2ce3336b7fa6debe8614c9ab81.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
noabu.exepid process 2628 noabu.exe 2628 noabu.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
noabu.exedescription pid process Token: SeDebugPrivilege 2628 noabu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6257af2ce3336b7fa6debe8614c9ab81.exedescription pid process target process PID 4012 wrote to memory of 2628 4012 6257af2ce3336b7fa6debe8614c9ab81.exe noabu.exe PID 4012 wrote to memory of 2628 4012 6257af2ce3336b7fa6debe8614c9ab81.exe noabu.exe PID 4012 wrote to memory of 2628 4012 6257af2ce3336b7fa6debe8614c9ab81.exe noabu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6257af2ce3336b7fa6debe8614c9ab81.exe"C:\Users\Admin\AppData\Local\Temp\6257af2ce3336b7fa6debe8614c9ab81.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exenoabu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exeMD5
b193f6ad44a0e3a55782e365ad1b0082
SHA1a3187be12fe673b70640096db4a62a52923a5dbb
SHA2561ad35ecffd662312ffa048ae8b85344267ebdd6d5c3be375c99b84c57d3ef117
SHA51259722aafb85543225a17743cefaec55128813569cf898554ce8b9ef818a3eba564248184e656db4d7333a5923e6c5bed56da6eb6626ecc31a9d66dbb0b2a4820
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exeMD5
b193f6ad44a0e3a55782e365ad1b0082
SHA1a3187be12fe673b70640096db4a62a52923a5dbb
SHA2561ad35ecffd662312ffa048ae8b85344267ebdd6d5c3be375c99b84c57d3ef117
SHA51259722aafb85543225a17743cefaec55128813569cf898554ce8b9ef818a3eba564248184e656db4d7333a5923e6c5bed56da6eb6626ecc31a9d66dbb0b2a4820
-
memory/2628-16-0x0000000004B40000-0x0000000004B6C000-memory.dmpFilesize
176KB
-
memory/2628-8-0x0000000002190000-0x0000000002191000-memory.dmpFilesize
4KB
-
memory/2628-18-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/2628-32-0x0000000007860000-0x0000000007861000-memory.dmpFilesize
4KB
-
memory/2628-20-0x0000000004BA2000-0x0000000004BA3000-memory.dmpFilesize
4KB
-
memory/2628-9-0x0000000002190000-0x0000000002191000-memory.dmpFilesize
4KB
-
memory/2628-10-0x0000000002310000-0x0000000002311000-memory.dmpFilesize
4KB
-
memory/2628-11-0x0000000000560000-0x0000000000597000-memory.dmpFilesize
220KB
-
memory/2628-12-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2628-13-0x0000000072DC0000-0x00000000734AE000-memory.dmpFilesize
6.9MB
-
memory/2628-14-0x00000000021E0000-0x000000000220E000-memory.dmpFilesize
184KB
-
memory/2628-19-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/2628-31-0x0000000007000000-0x0000000007001000-memory.dmpFilesize
4KB
-
memory/2628-17-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/2628-30-0x0000000006F50000-0x0000000006F51000-memory.dmpFilesize
4KB
-
memory/2628-5-0x0000000000000000-mapping.dmp
-
memory/2628-15-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/2628-21-0x0000000004BA3000-0x0000000004BA4000-memory.dmpFilesize
4KB
-
memory/2628-22-0x0000000004BA4000-0x0000000004BA6000-memory.dmpFilesize
8KB
-
memory/2628-23-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2628-24-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/2628-25-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/2628-26-0x00000000059E0000-0x00000000059E1000-memory.dmpFilesize
4KB
-
memory/2628-27-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/2628-28-0x0000000006730000-0x0000000006731000-memory.dmpFilesize
4KB
-
memory/2628-29-0x0000000006910000-0x0000000006911000-memory.dmpFilesize
4KB
-
memory/4012-4-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/4012-2-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/4012-3-0x00000000007C0000-0x000000000088F000-memory.dmpFilesize
828KB