Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-03-2021 08:21
Static task
static1
Behavioral task
behavioral1
Sample
ce0f93d2bb7f18632d6695cf4800f436.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ce0f93d2bb7f18632d6695cf4800f436.exe
Resource
win10v20201028
General
-
Target
ce0f93d2bb7f18632d6695cf4800f436.exe
-
Size
1.4MB
-
MD5
ce0f93d2bb7f18632d6695cf4800f436
-
SHA1
c36922e5580cf622752115f2c8fa95278ad455a7
-
SHA256
9624e9bf93ace2e4b9106fb1b30c1dfb9de68bf63f4fb9559f11078569fbe334
-
SHA512
df13fbc9df58029868f442b84f5b24cea6cab0fe019898dce524ed99876642db4ae0ad2226d35c7fa75f8a43644cfb36d3a9a4ad6c2bfe67ddd9709af604b99b
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1940-11-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral2/memory/1940-12-0x000000000041FA42-mapping.dmp family_redline -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
ce0f93d2bb7f18632d6695cf4800f436.exepid process 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ce0f93d2bb7f18632d6695cf4800f436.exedescription pid process target process PID 644 set thread context of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3464 644 WerFault.exe ce0f93d2bb7f18632d6695cf4800f436.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1196 timeout.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
ce0f93d2bb7f18632d6695cf4800f436.exeWerFault.exepid process 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 644 ce0f93d2bb7f18632d6695cf4800f436.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe 3464 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
ce0f93d2bb7f18632d6695cf4800f436.exeWerFault.exece0f93d2bb7f18632d6695cf4800f436.exedescription pid process Token: SeDebugPrivilege 644 ce0f93d2bb7f18632d6695cf4800f436.exe Token: SeRestorePrivilege 3464 WerFault.exe Token: SeBackupPrivilege 3464 WerFault.exe Token: SeDebugPrivilege 3464 WerFault.exe Token: SeDebugPrivilege 1940 ce0f93d2bb7f18632d6695cf4800f436.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ce0f93d2bb7f18632d6695cf4800f436.execmd.exedescription pid process target process PID 644 wrote to memory of 2836 644 ce0f93d2bb7f18632d6695cf4800f436.exe cmd.exe PID 644 wrote to memory of 2836 644 ce0f93d2bb7f18632d6695cf4800f436.exe cmd.exe PID 644 wrote to memory of 2836 644 ce0f93d2bb7f18632d6695cf4800f436.exe cmd.exe PID 2836 wrote to memory of 1196 2836 cmd.exe timeout.exe PID 2836 wrote to memory of 1196 2836 cmd.exe timeout.exe PID 2836 wrote to memory of 1196 2836 cmd.exe timeout.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe PID 644 wrote to memory of 1940 644 ce0f93d2bb7f18632d6695cf4800f436.exe ce0f93d2bb7f18632d6695cf4800f436.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce0f93d2bb7f18632d6695cf4800f436.exe"C:\Users\Admin\AppData\Local\Temp\ce0f93d2bb7f18632d6695cf4800f436.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\ce0f93d2bb7f18632d6695cf4800f436.exe"C:\Users\Admin\AppData\Local\Temp\ce0f93d2bb7f18632d6695cf4800f436.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 14642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-10-0x0000000006730000-0x0000000006731000-memory.dmpFilesize
4KB
-
memory/644-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/644-5-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/644-6-0x0000000005520000-0x0000000005551000-memory.dmpFilesize
196KB
-
memory/644-7-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/644-2-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/1196-9-0x0000000000000000-mapping.dmp
-
memory/1940-11-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1940-12-0x000000000041FA42-mapping.dmp
-
memory/1940-13-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/1940-16-0x00000000059F0000-0x00000000059F1000-memory.dmpFilesize
4KB
-
memory/1940-17-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/1940-18-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/1940-20-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/1940-21-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/1940-22-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2836-8-0x0000000000000000-mapping.dmp
-
memory/3464-19-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB