Analysis
- max time kernel
126s - max time network
129s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/02/2021, 07:53
General
- Target 5568305d237c162f48e7760523f7fb0c.exe
- Size 622KB
- Sample210219-pdgsd5elja
- SHA256 b479768bf30303be4d80d2ec21ea1a5cb116307e7c637a562b28c019acd515fa
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5568305d237c162f48e7760523f7fb0c.exe"C:\Users\Admin\AppData\Local\Temp\5568305d237c162f48e7760523f7fb0c.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\paperships\noabu.exenoabu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3008-4-0x0000000000A30000-0x0000000000AFF000-memory.dmp
memory/3008-5-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/3008-2-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/3956-17-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/3956-21-0x0000000004F83000-0x0000000004F84000-memory.dmp
memory/3956-10-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3956-11-0x0000000072760000-0x0000000072E4E000-memory.dmp
memory/3956-12-0x0000000000980000-0x00000000009B5000-memory.dmp
memory/3956-13-0x0000000000400000-0x0000000000438000-memory.dmp
memory/3956-14-0x0000000002770000-0x0000000002799000-memory.dmp
memory/3956-15-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3956-16-0x0000000002900000-0x0000000002927000-memory.dmp
memory/3956-18-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/3956-20-0x0000000004F82000-0x0000000004F83000-memory.dmp
memory/3956-19-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/3956-9-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/3956-22-0x0000000004F84000-0x0000000004F86000-memory.dmp
memory/3956-23-0x0000000005490000-0x0000000005491000-memory.dmp
memory/3956-24-0x0000000005B20000-0x0000000005B21000-memory.dmp
memory/3956-25-0x0000000005B40000-0x0000000005B41000-memory.dmp
memory/3956-26-0x0000000005CB0000-0x0000000005CB1000-memory.dmp
memory/3956-27-0x0000000005E30000-0x0000000005E31000-memory.dmp
memory/3956-28-0x00000000069F0000-0x00000000069F1000-memory.dmp
memory/3956-29-0x0000000006BE0000-0x0000000006BE1000-memory.dmp
memory/3956-30-0x0000000007220000-0x0000000007221000-memory.dmp
memory/3956-31-0x00000000072D0000-0x00000000072D1000-memory.dmp
memory/3956-32-0x0000000007C60000-0x0000000007C61000-memory.dmp