Analysis
-
max time kernel
124s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-02-2021 19:17
Static task
static1
Behavioral task
behavioral1
Sample
0236d3993de861cf53b05ad370166a4a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0236d3993de861cf53b05ad370166a4a.exe
Resource
win10v20201028
General
-
Target
0236d3993de861cf53b05ad370166a4a.exe
-
Size
622KB
-
MD5
0236d3993de861cf53b05ad370166a4a
-
SHA1
142cc937909cc40ada97c2f044ffcf8012a6be00
-
SHA256
7ba598295df994536137bc987b00344e609035b56a40c93354cde719cd4a2989
-
SHA512
0e06bd80e647a814861c3694910892961d4688171ebcb76cbcee897f9a8eb1870ce7a88196c130b4870d0cd0c8d8810968505be556e74d52720fd491fa47f83d
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3124-14-0x00000000049A0000-0x00000000049CC000-memory.dmp family_redline behavioral2/memory/3124-18-0x00000000077B0000-0x00000000077DA000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
noabu.exepid process 3124 noabu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
0236d3993de861cf53b05ad370166a4a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0236d3993de861cf53b05ad370166a4a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0236d3993de861cf53b05ad370166a4a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
noabu.exepid process 3124 noabu.exe 3124 noabu.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
noabu.exedescription pid process Token: SeDebugPrivilege 3124 noabu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0236d3993de861cf53b05ad370166a4a.exedescription pid process target process PID 644 wrote to memory of 3124 644 0236d3993de861cf53b05ad370166a4a.exe noabu.exe PID 644 wrote to memory of 3124 644 0236d3993de861cf53b05ad370166a4a.exe noabu.exe PID 644 wrote to memory of 3124 644 0236d3993de861cf53b05ad370166a4a.exe noabu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0236d3993de861cf53b05ad370166a4a.exe"C:\Users\Admin\AppData\Local\Temp\0236d3993de861cf53b05ad370166a4a.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exenoabu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exeMD5
30073d7cc81768ddd8e3bb1b08b9f144
SHA1439eb4d721bd814b04598890736685506a5bfcf1
SHA256ddd810853f9fa4626060db340eaf5c38b614b81be0dc05f92c0f5356431bc9c5
SHA512b90a32f870794b5e0f979774c16ee333ab032d24508a38949ddae095f87b7eb2754e3f84b8f1c234cbb219ea436ffea3e2da3d0379b9c9b7434df5b64039252a
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exeMD5
30073d7cc81768ddd8e3bb1b08b9f144
SHA1439eb4d721bd814b04598890736685506a5bfcf1
SHA256ddd810853f9fa4626060db340eaf5c38b614b81be0dc05f92c0f5356431bc9c5
SHA512b90a32f870794b5e0f979774c16ee333ab032d24508a38949ddae095f87b7eb2754e3f84b8f1c234cbb219ea436ffea3e2da3d0379b9c9b7434df5b64039252a
-
memory/644-3-0x0000000000A30000-0x0000000000AFF000-memory.dmpFilesize
828KB
-
memory/644-4-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/644-2-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/3124-16-0x0000000004A12000-0x0000000004A13000-memory.dmpFilesize
4KB
-
memory/3124-20-0x0000000007890000-0x0000000007891000-memory.dmpFilesize
4KB
-
memory/3124-9-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/3124-10-0x0000000002BF0000-0x0000000002C26000-memory.dmpFilesize
216KB
-
memory/3124-11-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/3124-12-0x00000000730A0000-0x000000007378E000-memory.dmpFilesize
6.9MB
-
memory/3124-13-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/3124-14-0x00000000049A0000-0x00000000049CC000-memory.dmpFilesize
176KB
-
memory/3124-15-0x00000000072B0000-0x00000000072B1000-memory.dmpFilesize
4KB
-
memory/3124-5-0x0000000000000000-mapping.dmp
-
memory/3124-17-0x0000000004A13000-0x0000000004A14000-memory.dmpFilesize
4KB
-
memory/3124-18-0x00000000077B0000-0x00000000077DA000-memory.dmpFilesize
168KB
-
memory/3124-19-0x00000000077E0000-0x00000000077E1000-memory.dmpFilesize
4KB
-
memory/3124-8-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/3124-21-0x0000000004A14000-0x0000000004A16000-memory.dmpFilesize
8KB
-
memory/3124-22-0x0000000007910000-0x0000000007911000-memory.dmpFilesize
4KB
-
memory/3124-23-0x0000000007FA0000-0x0000000007FA1000-memory.dmpFilesize
4KB
-
memory/3124-24-0x0000000007FC0000-0x0000000007FC1000-memory.dmpFilesize
4KB
-
memory/3124-25-0x0000000008130000-0x0000000008131000-memory.dmpFilesize
4KB
-
memory/3124-26-0x00000000082B0000-0x00000000082B1000-memory.dmpFilesize
4KB
-
memory/3124-27-0x0000000008E70000-0x0000000008E71000-memory.dmpFilesize
4KB
-
memory/3124-28-0x0000000009060000-0x0000000009061000-memory.dmpFilesize
4KB
-
memory/3124-29-0x00000000096A0000-0x00000000096A1000-memory.dmpFilesize
4KB
-
memory/3124-30-0x0000000009750000-0x0000000009751000-memory.dmpFilesize
4KB
-
memory/3124-31-0x0000000009FC0000-0x0000000009FC1000-memory.dmpFilesize
4KB