Analysis
-
max time kernel
39s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-03-2021 16:56
Static task
static1
Behavioral task
behavioral1
Sample
638127191.exe
Resource
win7v20201028
General
-
Target
638127191.exe
-
Size
256KB
-
MD5
5c9e61f7399d08070ee86d8796b4b126
-
SHA1
12e16e5c06ae479d216975ac63ac6a935ec9b189
-
SHA256
23861faf3ed06c8f76c905f6d592e3aacd4adfb0a63a3af08f94aa42c1a3f57f
-
SHA512
bc5243e325e9c57b743bf1919b84bff709387554b2f028a37aefcfa7b0e8f61c3265666d5a99e7fc24c5cae85ed7240f6856b70e70bd3c28d236edcb7fcc4226
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2420-38-0x000000000041E192-mapping.dmp family_redline behavioral2/memory/2420-37-0x0000000000400000-0x0000000000426000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
794066702.exe1712476341.exe1712476341.exepid process 2928 794066702.exe 188 1712476341.exe 2420 1712476341.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
1712476341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 1712476341.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1712476341.exe = "0" 1712476341.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
1712476341.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
1712476341.exepid process 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe 188 1712476341.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1712476341.exedescription pid process target process PID 188 set thread context of 2420 188 1712476341.exe 1712476341.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4000 2928 WerFault.exe 794066702.exe 1076 188 WerFault.exe 1712476341.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3204 timeout.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WerFault.exe1712476341.exepowershell.exeWerFault.exe1712476341.exepid process 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 188 1712476341.exe 2356 powershell.exe 188 1712476341.exe 188 1712476341.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 1076 WerFault.exe 2356 powershell.exe 2356 powershell.exe 2420 1712476341.exe 2420 1712476341.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
638127191.exeWerFault.exe1712476341.exepowershell.exeWerFault.exe1712476341.exedescription pid process Token: SeDebugPrivilege 2604 638127191.exe Token: SeRestorePrivilege 4000 WerFault.exe Token: SeBackupPrivilege 4000 WerFault.exe Token: SeDebugPrivilege 188 1712476341.exe Token: SeDebugPrivilege 4000 WerFault.exe Token: SeDebugPrivilege 2356 powershell.exe Token: SeDebugPrivilege 1076 WerFault.exe Token: SeDebugPrivilege 2420 1712476341.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
638127191.exe1712476341.execmd.exedescription pid process target process PID 2604 wrote to memory of 2928 2604 638127191.exe 794066702.exe PID 2604 wrote to memory of 2928 2604 638127191.exe 794066702.exe PID 2604 wrote to memory of 2928 2604 638127191.exe 794066702.exe PID 2604 wrote to memory of 188 2604 638127191.exe 1712476341.exe PID 2604 wrote to memory of 188 2604 638127191.exe 1712476341.exe PID 2604 wrote to memory of 188 2604 638127191.exe 1712476341.exe PID 188 wrote to memory of 2356 188 1712476341.exe powershell.exe PID 188 wrote to memory of 2356 188 1712476341.exe powershell.exe PID 188 wrote to memory of 2356 188 1712476341.exe powershell.exe PID 188 wrote to memory of 1864 188 1712476341.exe cmd.exe PID 188 wrote to memory of 1864 188 1712476341.exe cmd.exe PID 188 wrote to memory of 1864 188 1712476341.exe cmd.exe PID 1864 wrote to memory of 3204 1864 cmd.exe timeout.exe PID 1864 wrote to memory of 3204 1864 cmd.exe timeout.exe PID 1864 wrote to memory of 3204 1864 cmd.exe timeout.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe PID 188 wrote to memory of 2420 188 1712476341.exe 1712476341.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1712476341.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\638127191.exe"C:\Users\Admin\AppData\Local\Temp\638127191.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\794066702.exe"C:\Users\Admin\AppData\Local\Temp\794066702.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 2763⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1712476341.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 188 -s 19763⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
C:\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
memory/188-26-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/188-17-0x00000000738D0000-0x0000000073FBE000-memory.dmpFilesize
6.9MB
-
memory/188-25-0x0000000008540000-0x0000000008541000-memory.dmpFilesize
4KB
-
memory/188-24-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/188-27-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/188-18-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/188-28-0x0000000007180000-0x0000000007216000-memory.dmpFilesize
600KB
-
memory/188-14-0x0000000000000000-mapping.dmp
-
memory/1076-47-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/1864-30-0x0000000000000000-mapping.dmp
-
memory/2356-36-0x00000000070A2000-0x00000000070A3000-memory.dmpFilesize
4KB
-
memory/2356-64-0x000000007E540000-0x000000007E541000-memory.dmpFilesize
4KB
-
memory/2356-72-0x0000000009830000-0x0000000009831000-memory.dmpFilesize
4KB
-
memory/2356-69-0x0000000009840000-0x0000000009841000-memory.dmpFilesize
4KB
-
memory/2356-65-0x00000000070A3000-0x00000000070A4000-memory.dmpFilesize
4KB
-
memory/2356-63-0x0000000009890000-0x0000000009891000-memory.dmpFilesize
4KB
-
memory/2356-62-0x00000000096D0000-0x00000000096D1000-memory.dmpFilesize
4KB
-
memory/2356-61-0x0000000009360000-0x0000000009361000-memory.dmpFilesize
4KB
-
memory/2356-54-0x0000000009380000-0x00000000093B3000-memory.dmpFilesize
204KB
-
memory/2356-29-0x0000000000000000-mapping.dmp
-
memory/2356-51-0x0000000008680000-0x0000000008681000-memory.dmpFilesize
4KB
-
memory/2356-31-0x00000000738D0000-0x0000000073FBE000-memory.dmpFilesize
6.9MB
-
memory/2356-32-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/2356-33-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/2356-50-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/2356-35-0x00000000070A0000-0x00000000070A1000-memory.dmpFilesize
4KB
-
memory/2356-48-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/2356-46-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/2356-44-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/2356-41-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/2420-40-0x00000000738D0000-0x0000000073FBE000-memory.dmpFilesize
6.9MB
-
memory/2420-66-0x0000000005D00000-0x0000000005D01000-memory.dmpFilesize
4KB
-
memory/2420-37-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2420-45-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/2420-38-0x000000000041E192-mapping.dmp
-
memory/2420-81-0x0000000001821000-0x0000000001822000-memory.dmpFilesize
4KB
-
memory/2420-82-0x0000000007860000-0x0000000007861000-memory.dmpFilesize
4KB
-
memory/2420-49-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/2420-75-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB
-
memory/2420-76-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB
-
memory/2420-77-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/2420-71-0x0000000005FB0000-0x0000000005FB1000-memory.dmpFilesize
4KB
-
memory/2420-68-0x0000000005F50000-0x0000000005F51000-memory.dmpFilesize
4KB
-
memory/2420-67-0x00000000064B0000-0x00000000064B1000-memory.dmpFilesize
4KB
-
memory/2604-2-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/2604-10-0x0000000004BA4000-0x0000000004BA6000-memory.dmpFilesize
8KB
-
memory/2604-9-0x0000000004BA3000-0x0000000004BA4000-memory.dmpFilesize
4KB
-
memory/2604-8-0x0000000004BA2000-0x0000000004BA3000-memory.dmpFilesize
4KB
-
memory/2604-7-0x0000000004A40000-0x0000000004A49000-memory.dmpFilesize
36KB
-
memory/2604-6-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/2604-5-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/2604-3-0x00000000738D0000-0x0000000073FBE000-memory.dmpFilesize
6.9MB
-
memory/2604-4-0x0000000002120000-0x000000000212A000-memory.dmpFilesize
40KB
-
memory/2928-11-0x0000000000000000-mapping.dmp
-
memory/3204-34-0x0000000000000000-mapping.dmp
-
memory/4000-22-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/4000-21-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB