Overview
overview
10Static
static
Document.p...in.xml
windows10-2004-x64
1Document.p...ce.xml
windows10-2004-x64
1Document.p...ms.xml
windows10-2004-x64
1Document.p...at.xml
windows10-2004-x64
1Document.p...me.xml
windows10-2004-x64
1Document.p...er.xml
windows10-2004-x64
1Document.p...er.xml
windows10-2004-x64
1Document.p...gs.xml
windows10-2004-x64
1Document.p...ay.xml
windows10-2004-x64
1Document.p...cs.xml
windows10-2004-x64
1Document.p...ts.xml
windows10-2004-x64
1Document.p...le.xml
windows10-2004-x64
1Document.p...OM.xml
windows10-2004-x64
1Document.p...er.xml
windows10-2004-x64
1Document.p...nf.xml
windows10-2004-x64
1Document.p...el.xml
windows10-2004-x64
1Document.p...ay.xml
windows10-2004-x64
1Document.p...ls.xml
windows10-2004-x64
1Document.p...sp.xml
windows10-2004-x64
1Document.p...UI.xml
windows10-2004-x64
1Document.p...rs.xml
windows10-2004-x64
1Document.p...el.xml
windows10-2004-x64
1Document.p...OM.xml
windows10-2004-x64
1Document.p...FS.xml
windows10-2004-x64
1Document.p...WM.xml
windows10-2004-x64
1Document.p...at.xml
windows10-2004-x64
1Document.p...on.xml
windows10-2004-x64
1Document.p...up.xml
windows10-2004-x64
1Document.p...er.xml
windows10-2004-x64
1Document.p...ic.xml
windows10-2004-x64
1Document.p...he.xml
windows10-2004-x64
1Document.p...df.scr
windows10-2004-x64
10Analysis
-
max time kernel
449s -
max time network
510s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-de -
resource tags
arch:x64arch:x86image:win10v2004-20220721-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
24-07-2022 15:09
Static task
static1
Behavioral task
behavioral1
Sample
Document.pdf/App Settings/WorkplaceJoin.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral2
Sample
Document.pdf/App Settings/en-US/ActiveXInstallService.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral3
Sample
Document.pdf/App Settings/en-US/AddRemovePrograms.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral4
Sample
Document.pdf/App Settings/en-US/AppCompat.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral5
Sample
Document.pdf/App Settings/en-US/AppXRuntime.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral6
Sample
Document.pdf/App Settings/en-US/AppxPackageManager.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral7
Sample
Document.pdf/App Settings/en-US/AttachmentManager.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral8
Sample
Document.pdf/App Settings/en-US/AuditSettings.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral9
Sample
Document.pdf/App Settings/en-US/AutoPlay.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral10
Sample
Document.pdf/App Settings/en-US/Biometrics.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral11
Sample
Document.pdf/App Settings/en-US/Bits.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral12
Sample
Document.pdf/App Settings/en-US/CEIPEnable.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral13
Sample
Document.pdf/App Settings/en-US/COM.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral14
Sample
Document.pdf/App Settings/en-US/CipherSuiteOrder.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral15
Sample
Document.pdf/App Settings/en-US/Conf.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral16
Sample
Document.pdf/App Settings/en-US/ControlPanel.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral17
Sample
Document.pdf/App Settings/en-US/ControlPanelDisplay.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral18
Sample
Document.pdf/App Settings/en-US/Cpls.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral19
Sample
Document.pdf/App Settings/en-US/CredSsp.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral20
Sample
Document.pdf/App Settings/en-US/CredUI.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral21
Sample
Document.pdf/App Settings/en-US/CredentialProviders.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral22
Sample
Document.pdf/App Settings/en-US/CtrlAltDel.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral23
Sample
Document.pdf/App Settings/en-US/DCOM.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral24
Sample
Document.pdf/App Settings/en-US/DFS.xml
Resource
win10v2004-20220722-de
Behavioral task
behavioral25
Sample
Document.pdf/App Settings/en-US/DWM.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral26
Sample
Document.pdf/App Settings/en-US/DeviceCompat.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral27
Sample
Document.pdf/App Settings/en-US/DeviceInstallation.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral28
Sample
Document.pdf/App Settings/en-US/DeviceSetup.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral29
Sample
Document.pdf/App Settings/en-US/DigitalLocker.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral30
Sample
Document.pdf/App Settings/en-US/DiskDiagnostic.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral31
Sample
Document.pdf/App Settings/en-US/DiskNVCache.xml
Resource
win10v2004-20220721-de
Behavioral task
behavioral32
Sample
Document.pdf/Document.pdf.scr
Resource
win10v2004-20220721-de
General
-
Target
Document.pdf/Document.pdf.scr
-
Size
700.0MB
-
MD5
ea7b8236ca438995b2ee7604043fc20c
-
SHA1
4543d6fbe467c8a17b962e0c19a25fd59d82ded8
-
SHA256
954e35d28e5938766eb6922e08a4e26d5ed892a1578027374d945efbe0d927e3
-
SHA512
22a1173def10e7c74fbcef024127f87635a508044c4fbbfa2f4e32b05823b5fc9fa166645851dbaa32c926a735745ca727dc0183a72fd9f3cc222f9f07395a7a
Malware Config
Extracted
redline
1
62.204.41.139:25190
-
auth_value
2c239ad7c28c8eab1f9626557bb9457a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral32/memory/2852-144-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Document.pdf.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation Document.pdf.scr -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 2736 set thread context of 2852 2736 Document.pdf.scr AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeDocument.pdf.scrAppLaunch.exepid process 1376 powershell.exe 1376 powershell.exe 2736 Document.pdf.scr 2736 Document.pdf.scr 2852 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Document.pdf.scrpowershell.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 2736 Document.pdf.scr Token: SeDebugPrivilege 1376 powershell.exe Token: SeDebugPrivilege 2852 AppLaunch.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 2736 wrote to memory of 1376 2736 Document.pdf.scr powershell.exe PID 2736 wrote to memory of 1376 2736 Document.pdf.scr powershell.exe PID 2736 wrote to memory of 1376 2736 Document.pdf.scr powershell.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe PID 2736 wrote to memory of 2852 2736 Document.pdf.scr AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.pdf\Document.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Document.pdf\Document.pdf.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-142-0x0000000006710000-0x000000000672A000-memory.dmpFilesize
104KB
-
memory/1376-133-0x0000000002A60000-0x0000000002A96000-memory.dmpFilesize
216KB
-
memory/1376-134-0x0000000005280000-0x00000000058A8000-memory.dmpFilesize
6.2MB
-
memory/1376-135-0x00000000050B0000-0x0000000005136000-memory.dmpFilesize
536KB
-
memory/1376-136-0x0000000005960000-0x00000000059C6000-memory.dmpFilesize
408KB
-
memory/1376-137-0x0000000005A80000-0x0000000005AE6000-memory.dmpFilesize
408KB
-
memory/1376-138-0x0000000005A50000-0x0000000005A60000-memory.dmpFilesize
64KB
-
memory/1376-139-0x0000000006070000-0x0000000006174000-memory.dmpFilesize
1.0MB
-
memory/1376-140-0x0000000006210000-0x000000000622E000-memory.dmpFilesize
120KB
-
memory/1376-141-0x0000000007A50000-0x00000000080CA000-memory.dmpFilesize
6.5MB
-
memory/1376-132-0x0000000000000000-mapping.dmp
-
memory/2736-131-0x0000000005DA0000-0x0000000005DC2000-memory.dmpFilesize
136KB
-
memory/2736-130-0x0000000000530000-0x0000000000756000-memory.dmpFilesize
2.1MB
-
memory/2852-156-0x00000000071F0000-0x0000000007240000-memory.dmpFilesize
320KB
-
memory/2852-151-0x0000000006440000-0x00000000064D2000-memory.dmpFilesize
584KB
-
memory/2852-145-0x0000000005B10000-0x0000000006128000-memory.dmpFilesize
6.1MB
-
memory/2852-146-0x0000000005540000-0x0000000005552000-memory.dmpFilesize
72KB
-
memory/2852-147-0x0000000005670000-0x000000000577A000-memory.dmpFilesize
1.0MB
-
memory/2852-148-0x00000000055A0000-0x00000000055DC000-memory.dmpFilesize
240KB
-
memory/2852-149-0x0000000005AD0000-0x0000000005AF0000-memory.dmpFilesize
128KB
-
memory/2852-150-0x0000000006910000-0x0000000006EB4000-memory.dmpFilesize
5.6MB
-
memory/2852-144-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2852-152-0x0000000006700000-0x0000000006776000-memory.dmpFilesize
472KB
-
memory/2852-153-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/2852-154-0x0000000007DE0000-0x0000000007FA2000-memory.dmpFilesize
1.8MB
-
memory/2852-155-0x00000000084E0000-0x0000000008A0C000-memory.dmpFilesize
5.2MB
-
memory/2852-143-0x0000000000000000-mapping.dmp