Analysis
- max time kernel
139s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - resource tags
- submitted
18/07/2022, 10:16
General
- Target swift pdf.exe
- Size 739KB
- Sample220718-massvabdc6
- SHA256 cc355fc1b46dccf580e160778acdfd476c848f22acdeeafd8e5dac7c8f734913
Malware Config
Extracted
-
redline
-
ATNNN
-
192.227.128.150:6757
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\swift pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift pdf.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\swift pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\swift pdf.exe"C:\Users\Admin\AppData\Local\Temp\swift pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
swift pdf.exe.log
memory/1960-131-0x0000000006170000-0x0000000006714000-memory.dmp
memory/1960-132-0x0000000005A80000-0x0000000005B12000-memory.dmp
memory/1960-133-0x00000000034B0000-0x00000000034BA000-memory.dmp
memory/1960-134-0x0000000008CC0000-0x0000000008D5C000-memory.dmp
memory/1960-130-0x0000000000FC0000-0x0000000001080000-memory.dmp
memory/1960-136-0x0000000009510000-0x0000000009576000-memory.dmp
memory/2692-154-0x0000000007980000-0x000000000798A000-memory.dmp
memory/2692-156-0x0000000007B40000-0x0000000007B4E000-memory.dmp
memory/2692-158-0x0000000007C30000-0x0000000007C38000-memory.dmp
memory/2692-157-0x0000000007C50000-0x0000000007C6A000-memory.dmp
memory/2692-141-0x0000000005630000-0x0000000005652000-memory.dmp
memory/2692-137-0x0000000002D00000-0x0000000002D36000-memory.dmp
memory/2692-143-0x0000000005F40000-0x0000000005FA6000-memory.dmp
memory/2692-138-0x00000000058A0000-0x0000000005EC8000-memory.dmp
memory/2692-155-0x0000000007B90000-0x0000000007C26000-memory.dmp
memory/2692-147-0x0000000006600000-0x000000000661E000-memory.dmp
memory/2692-153-0x0000000007910000-0x000000000792A000-memory.dmp
memory/2692-149-0x0000000006BB0000-0x0000000006BE2000-memory.dmp
memory/2692-150-0x0000000070890000-0x00000000708DC000-memory.dmp
memory/2692-151-0x0000000006B90000-0x0000000006BAE000-memory.dmp
memory/2692-152-0x0000000007F50000-0x00000000085CA000-memory.dmp
memory/4160-148-0x0000000005560000-0x000000000566A000-memory.dmp
memory/4160-146-0x00000000052B0000-0x00000000052EC000-memory.dmp
memory/4160-145-0x0000000005240000-0x0000000005252000-memory.dmp
memory/4160-144-0x00000000058D0000-0x0000000005EE8000-memory.dmp
memory/4160-140-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4160-159-0x0000000006840000-0x0000000006A02000-memory.dmp
memory/4160-160-0x0000000006F40000-0x000000000746C000-memory.dmp
memory/4160-161-0x0000000006D20000-0x0000000006D96000-memory.dmp
memory/4160-162-0x0000000006E40000-0x0000000006E5E000-memory.dmp