Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    19-02-2021 07:15

General

  • Target

    94d10248e883fe1db598a3cebe5e278f.exe

  • Size

    530KB

  • MD5

    94d10248e883fe1db598a3cebe5e278f

  • SHA1

    24e2ac688f803c8f723c789c42db986028c97358

  • SHA256

    5880defb149df28092091f832476cbabc5f67c8f59e87f3c922204a8ec461791

  • SHA512

    73c4173d14e4a93966a2d2fe19c9ff5921278e722fe9772aa17f402ddfcc300b651dc602c7d6feaa441f783f37d447032a30a0fcb3c25936232262a9debb2959

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94d10248e883fe1db598a3cebe5e278f.exe
    "C:\Users\Admin\AppData\Local\Temp\94d10248e883fe1db598a3cebe5e278f.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
      noabu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:396

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
    MD5

    41ccae281672141f14028e730c70b618

    SHA1

    02de56652fa90ab1304c4b22f394ba9d5e132dfd

    SHA256

    0e09d3298aae4a2a440ae32321a8f6db607e9cb072156b17eb8fb12b212c1cf6

    SHA512

    e59a4a14c27365fad90b08feaca57c825f4c6c74b0f551ab0fc652b366d78a26672f85ef37f25249c8d92fe4163773a19eb494ca27cf54fc2d0c704dcfdc95c4

  • \Users\Admin\AppData\Roaming\paperships\noabu.exe
    MD5

    41ccae281672141f14028e730c70b618

    SHA1

    02de56652fa90ab1304c4b22f394ba9d5e132dfd

    SHA256

    0e09d3298aae4a2a440ae32321a8f6db607e9cb072156b17eb8fb12b212c1cf6

    SHA512

    e59a4a14c27365fad90b08feaca57c825f4c6c74b0f551ab0fc652b366d78a26672f85ef37f25249c8d92fe4163773a19eb494ca27cf54fc2d0c704dcfdc95c4

  • memory/396-14-0x0000000000230000-0x0000000000265000-memory.dmp
    Filesize

    212KB

  • memory/396-17-0x0000000002652000-0x0000000002653000-memory.dmp
    Filesize

    4KB

  • memory/396-20-0x0000000002654000-0x0000000002656000-memory.dmp
    Filesize

    8KB

  • memory/396-19-0x0000000002610000-0x0000000002637000-memory.dmp
    Filesize

    156KB

  • memory/396-8-0x0000000000000000-mapping.dmp
  • memory/396-18-0x0000000002653000-0x0000000002654000-memory.dmp
    Filesize

    4KB

  • memory/396-10-0x0000000000C20000-0x0000000000C31000-memory.dmp
    Filesize

    68KB

  • memory/396-11-0x0000000002380000-0x0000000002391000-memory.dmp
    Filesize

    68KB

  • memory/396-12-0x0000000073FA0000-0x000000007468E000-memory.dmp
    Filesize

    6.9MB

  • memory/396-13-0x0000000000DB0000-0x0000000000DD9000-memory.dmp
    Filesize

    164KB

  • memory/396-16-0x0000000002651000-0x0000000002652000-memory.dmp
    Filesize

    4KB

  • memory/396-15-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

  • memory/1396-6-0x000007FEF6400000-0x000007FEF667A000-memory.dmp
    Filesize

    2.5MB

  • memory/1732-2-0x0000000000AA0000-0x0000000000AB1000-memory.dmp
    Filesize

    68KB

  • memory/1732-5-0x0000000000400000-0x00000000004D5000-memory.dmp
    Filesize

    852KB

  • memory/1732-3-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
    Filesize

    8KB

  • memory/1732-4-0x00000000008F0000-0x00000000009BF000-memory.dmp
    Filesize

    828KB