Analysis

  • max time kernel
    21s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25-02-2021 11:13

General

  • Target

    1159b5c0e7acc0d01f99c456b5a2e17a.exe

  • Size

    650KB

  • MD5

    1159b5c0e7acc0d01f99c456b5a2e17a

  • SHA1

    3e4a02c3cb4b0c6dd2d462a6ae94e0777bcdbc8a

  • SHA256

    b3c2ed1edebee42767277652dbdb2c3c17c3b33707c975b1679e956658701825

  • SHA512

    c884d969ef71af279bfc5e54f6a5323d9e9f698cb2b3140d16773776d7bade875653bb018cbb40fa0bc69232221506dc8fae95c58a98618d9f742e936a27e838

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1159b5c0e7acc0d01f99c456b5a2e17a.exe
    "C:\Users\Admin\AppData\Local\Temp\1159b5c0e7acc0d01f99c456b5a2e17a.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 752
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 856
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1204
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1568
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1540
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1524
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
      noabu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1676
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1900
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 1864
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3220

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
    MD5

    bdfdca6660e6fe6cabe4dcc397154975

    SHA1

    6e7130d78356acb749f11b60e10244ea9ba267a2

    SHA256

    3a77d697b35b9de741ac611c904aca942a17d4ac8f786f4f9b9532dec277a8f6

    SHA512

    f7dc745eecfa2f8df6fa54bd1c98333e3c27123dd02bdcc91f9e96950393169a906d611d260a6863b36f22e6fa00c9fdabdd6e2bd24e7aaed50d265b19e03327

  • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
    MD5

    bdfdca6660e6fe6cabe4dcc397154975

    SHA1

    6e7130d78356acb749f11b60e10244ea9ba267a2

    SHA256

    3a77d697b35b9de741ac611c904aca942a17d4ac8f786f4f9b9532dec277a8f6

    SHA512

    f7dc745eecfa2f8df6fa54bd1c98333e3c27123dd02bdcc91f9e96950393169a906d611d260a6863b36f22e6fa00c9fdabdd6e2bd24e7aaed50d265b19e03327

  • memory/492-2-0x0000000000C40000-0x0000000000C41000-memory.dmp
    Filesize

    4KB

  • memory/492-4-0x0000000000400000-0x00000000004D5000-memory.dmp
    Filesize

    852KB

  • memory/492-3-0x0000000000A20000-0x0000000000AEF000-memory.dmp
    Filesize

    828KB

  • memory/860-12-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/980-21-0x0000000004E30000-0x0000000004E31000-memory.dmp
    Filesize

    4KB

  • memory/1008-27-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/1644-88-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

  • memory/1644-119-0x00000000054D0000-0x00000000054D1000-memory.dmp
    Filesize

    4KB

  • memory/1644-61-0x0000000004E60000-0x0000000004E61000-memory.dmp
    Filesize

    4KB

  • memory/1644-76-0x0000000005360000-0x0000000005361000-memory.dmp
    Filesize

    4KB

  • memory/1644-24-0x0000000000000000-mapping.dmp
  • memory/1644-33-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
    Filesize

    4KB

  • memory/1644-34-0x00000000026C0000-0x00000000026C1000-memory.dmp
    Filesize

    4KB

  • memory/1644-137-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
    Filesize

    4KB

  • memory/1644-37-0x0000000071B70000-0x000000007225E000-memory.dmp
    Filesize

    6.9MB

  • memory/1644-136-0x0000000007270000-0x0000000007271000-memory.dmp
    Filesize

    4KB

  • memory/1644-135-0x00000000071C0000-0x00000000071C1000-memory.dmp
    Filesize

    4KB

  • memory/1644-134-0x0000000006B90000-0x0000000006B91000-memory.dmp
    Filesize

    4KB

  • memory/1644-133-0x00000000069C0000-0x00000000069C1000-memory.dmp
    Filesize

    4KB

  • memory/1644-132-0x00000000057C0000-0x00000000057C1000-memory.dmp
    Filesize

    4KB

  • memory/1644-131-0x0000000005640000-0x0000000005641000-memory.dmp
    Filesize

    4KB

  • memory/1644-90-0x0000000004E10000-0x0000000004E11000-memory.dmp
    Filesize

    4KB

  • memory/1644-114-0x00000000054B0000-0x00000000054B1000-memory.dmp
    Filesize

    4KB

  • memory/1644-108-0x0000000005A30000-0x0000000005A31000-memory.dmp
    Filesize

    4KB

  • memory/1644-86-0x0000000000C50000-0x0000000000C85000-memory.dmp
    Filesize

    212KB

  • memory/1644-68-0x0000000002960000-0x0000000002987000-memory.dmp
    Filesize

    156KB

  • memory/1644-97-0x0000000004E53000-0x0000000004E54000-memory.dmp
    Filesize

    4KB

  • memory/1644-96-0x0000000004E52000-0x0000000004E53000-memory.dmp
    Filesize

    4KB

  • memory/1644-94-0x0000000004E50000-0x0000000004E51000-memory.dmp
    Filesize

    4KB

  • memory/1644-92-0x0000000004E54000-0x0000000004E56000-memory.dmp
    Filesize

    8KB

  • memory/1644-57-0x0000000002610000-0x0000000002639000-memory.dmp
    Filesize

    164KB

  • memory/1896-15-0x00000000046F0000-0x00000000046F1000-memory.dmp
    Filesize

    4KB

  • memory/2112-6-0x0000000004A70000-0x0000000004A71000-memory.dmp
    Filesize

    4KB

  • memory/2112-5-0x0000000004A70000-0x0000000004A71000-memory.dmp
    Filesize

    4KB

  • memory/3184-30-0x00000000046F0000-0x00000000046F1000-memory.dmp
    Filesize

    4KB

  • memory/3220-81-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-51-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-63-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-64-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-65-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-66-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-60-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-67-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-70-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-71-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-69-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-72-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-74-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-75-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-73-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-59-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-77-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-80-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-78-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-56-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-79-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-82-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-83-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-84-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-85-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-87-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-58-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-55-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-54-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-53-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-52-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-98-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-100-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-99-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-101-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-95-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-93-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-91-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-89-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-62-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-50-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-102-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-103-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-104-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-105-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-106-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-107-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-49-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-110-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-109-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-112-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-111-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-115-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-117-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-116-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-47-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-118-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-120-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-48-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-121-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-113-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-122-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-123-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-124-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-125-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-126-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-128-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-129-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-46-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-45-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-44-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-43-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-42-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-41-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3220-35-0x0000000004350000-0x0000000004351000-memory.dmp
    Filesize

    4KB

  • memory/3904-8-0x0000000004900000-0x0000000004901000-memory.dmp
    Filesize

    4KB

  • memory/3904-11-0x0000000004900000-0x0000000004901000-memory.dmp
    Filesize

    4KB

  • memory/3920-18-0x00000000046F0000-0x00000000046F1000-memory.dmp
    Filesize

    4KB