Overview

overview

10

Static

static

2e43eefac0...a8.exe

windows7_x64

10

2e43eefac0...a8.exe

windows10_x64

10

Analysis

  • max time kernel
    99s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25-02-2021 11:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2e43eefac0cbf1deb40b97d307a5f9a8.exe

  • Size

    650KB

  • MD5

    2e43eefac0cbf1deb40b97d307a5f9a8

  • SHA1

    936963b3b7da5c6addbb7dc323e65df58be56ad8

  • SHA256

    95c5c298a4e0b3a381d03d5c32d4bd420050aa6d4833a7aadf5607885a97ece3

  • SHA512

    d2c64a59a071ec9827c24e9d23b852866268ff8ab0a3d03f444c06fcda7029488d637a2a5ed1953a0c2655bea52607005e93a3c971729c1ed9c686df68cefa95

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e43eefac0cbf1deb40b97d307a5f9a8.exe
    "C:\Users\Admin\AppData\Local\Temp\2e43eefac0cbf1deb40b97d307a5f9a8.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 760
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 868
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1212
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1216
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1592
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1608
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3892
    • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
      noabu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3952
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1636
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1916
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 1924
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
    MD5

    bdfdca6660e6fe6cabe4dcc397154975

    SHA1

    6e7130d78356acb749f11b60e10244ea9ba267a2

    SHA256

    3a77d697b35b9de741ac611c904aca942a17d4ac8f786f4f9b9532dec277a8f6

    SHA512

    f7dc745eecfa2f8df6fa54bd1c98333e3c27123dd02bdcc91f9e96950393169a906d611d260a6863b36f22e6fa00c9fdabdd6e2bd24e7aaed50d265b19e03327

    Download Submit
  • C:\Users\Admin\AppData\Roaming\paperships\noabu.exe
    MD5

    bdfdca6660e6fe6cabe4dcc397154975

    SHA1

    6e7130d78356acb749f11b60e10244ea9ba267a2

    SHA256

    3a77d697b35b9de741ac611c904aca942a17d4ac8f786f4f9b9532dec277a8f6

    SHA512

    f7dc745eecfa2f8df6fa54bd1c98333e3c27123dd02bdcc91f9e96950393169a906d611d260a6863b36f22e6fa00c9fdabdd6e2bd24e7aaed50d265b19e03327

    Download Submit
  • memory/1864-17-0x00000000044D0000-0x00000000044D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2500-11-0x00000000042F0000-0x00000000042F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3248-3-0x0000000000A10000-0x0000000000ADF000-memory.dmp
    Filesize

    828KB

    Download
  • memory/3248-4-0x0000000000400000-0x00000000004D5000-memory.dmp
    Filesize

    852KB

    Download
  • memory/3248-2-0x0000000000E00000-0x0000000000E01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3272-14-0x0000000004A10000-0x0000000004A11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3296-6-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3296-5-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3640-39-0x0000000004B20000-0x0000000004B21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3892-20-0x0000000004240000-0x0000000004241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3944-43-0x0000000004940000-0x0000000004941000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-34-0x00000000027D0000-0x00000000027F9000-memory.dmp
    Filesize

    164KB

    Download
  • memory/3952-51-0x0000000005034000-0x0000000005036000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3952-28-0x00000000009C0000-0x00000000009F5000-memory.dmp
    Filesize

    212KB

    Download
  • memory/3952-29-0x0000000000400000-0x0000000000438000-memory.dmp
    Filesize

    224KB

    Download
  • memory/3952-30-0x0000000072960000-0x000000007304E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/3952-58-0x0000000007BE0000-0x0000000007BE1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-35-0x0000000005030000-0x0000000005031000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-26-0x0000000000D60000-0x0000000000D61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-36-0x0000000005032000-0x0000000005033000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-37-0x0000000005040000-0x0000000005041000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-38-0x0000000004EE0000-0x0000000004F07000-memory.dmp
    Filesize

    156KB

    Download
  • memory/3952-23-0x0000000000000000-mapping.dmp
    Download
  • memory/3952-42-0x0000000004F10000-0x0000000004F11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-57-0x00000000073B0000-0x00000000073B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-46-0x0000000005033000-0x0000000005034000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-47-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-48-0x0000000005560000-0x0000000005561000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-49-0x0000000005C00000-0x0000000005C01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-50-0x0000000005C20000-0x0000000005C21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-27-0x0000000002820000-0x0000000002821000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-52-0x0000000005D90000-0x0000000005D91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-53-0x0000000005F10000-0x0000000005F11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-54-0x0000000006AD0000-0x0000000006AD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-55-0x0000000006CC0000-0x0000000006CC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3952-56-0x0000000007300000-0x0000000007301000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3972-31-0x00000000047D0000-0x00000000047D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4040-8-0x0000000004160000-0x0000000004161000-memory.dmp
    Filesize

    4KB

    Download