Analysis
-
max time kernel
52s -
max time network
77s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
25-07-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
Document.pdf.scr.exe
Resource
win10-20220718-en
General
-
Target
Document.pdf.scr.exe
-
Size
2.1MB
-
MD5
93dd6479d9333cac3202b3ea9502a07c
-
SHA1
27ba3ddc97cb409b9d9b7c61dfb442c1c4655bee
-
SHA256
801e8af2f94a4b713c6d137eaa2c604b31b238038a6ffd6d7543b0089cc88ab9
-
SHA512
948f9a6ce1a02437263b2a6ad332e7a3c5e751776c9fe455b0aa605ac99dd87611b4a1386c4ba908d65455fa012228f99ba4a2501956afb8cc7ceaa03475f7e9
Malware Config
Extracted
redline
1
62.204.41.139:25190
-
auth_value
2c239ad7c28c8eab1f9626557bb9457a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4432-287-0x000000000041ADB2-mapping.dmp family_redline behavioral1/memory/4432-324-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Document.pdf.scr.exedescription pid process target process PID 2348 set thread context of 4432 2348 Document.pdf.scr.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exeDocument.pdf.scr.exeAppLaunch.exepid process 4596 powershell.exe 4596 powershell.exe 4596 powershell.exe 2348 Document.pdf.scr.exe 2348 Document.pdf.scr.exe 2348 Document.pdf.scr.exe 2348 Document.pdf.scr.exe 2348 Document.pdf.scr.exe 2348 Document.pdf.scr.exe 4432 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Document.pdf.scr.exepowershell.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 2348 Document.pdf.scr.exe Token: SeDebugPrivilege 4596 powershell.exe Token: SeDebugPrivilege 4432 AppLaunch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Document.pdf.scr.exedescription pid process target process PID 2348 wrote to memory of 4596 2348 Document.pdf.scr.exe powershell.exe PID 2348 wrote to memory of 4596 2348 Document.pdf.scr.exe powershell.exe PID 2348 wrote to memory of 4596 2348 Document.pdf.scr.exe powershell.exe PID 2348 wrote to memory of 4472 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4472 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4472 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe PID 2348 wrote to memory of 4432 2348 Document.pdf.scr.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr.exe"C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2348-163-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-138-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-119-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-120-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-121-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-122-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-123-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-124-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-125-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-126-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-127-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-128-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-129-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-130-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-131-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-117-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-133-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-134-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-135-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-136-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-137-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-162-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-139-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-140-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-141-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-142-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-143-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-144-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-145-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-146-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-147-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-161-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-149-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-150-0x0000000000990000-0x0000000000BB6000-memory.dmpFilesize
2.1MB
-
memory/2348-151-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-152-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-153-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-154-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-155-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-156-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-157-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-159-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-158-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-160-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-148-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-118-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-132-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-164-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-165-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-166-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-167-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-168-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-169-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-170-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-171-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-172-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-173-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-174-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-175-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-176-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-177-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-178-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-179-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-180-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-181-0x0000000077920000-0x0000000077AAE000-memory.dmpFilesize
1.6MB
-
memory/2348-185-0x0000000005D10000-0x0000000005D72000-memory.dmpFilesize
392KB
-
memory/2348-186-0x0000000005DE0000-0x0000000005E72000-memory.dmpFilesize
584KB
-
memory/2348-187-0x0000000005EC0000-0x0000000005EE2000-memory.dmpFilesize
136KB
-
memory/2348-189-0x0000000005EF0000-0x0000000006240000-memory.dmpFilesize
3.3MB
-
memory/4432-350-0x0000000009050000-0x000000000908E000-memory.dmpFilesize
248KB
-
memory/4432-324-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4432-345-0x0000000009550000-0x0000000009B56000-memory.dmpFilesize
6.0MB
-
memory/4432-346-0x0000000008FF0000-0x0000000009002000-memory.dmpFilesize
72KB
-
memory/4432-347-0x0000000009120000-0x000000000922A000-memory.dmpFilesize
1.0MB
-
memory/4432-287-0x000000000041ADB2-mapping.dmp
-
memory/4432-352-0x0000000009090000-0x00000000090DB000-memory.dmpFilesize
300KB
-
memory/4432-386-0x000000000B3B0000-0x000000000B8DC000-memory.dmpFilesize
5.2MB
-
memory/4432-385-0x000000000ACB0000-0x000000000AE72000-memory.dmpFilesize
1.8MB
-
memory/4432-376-0x000000000A3D0000-0x000000000A420000-memory.dmpFilesize
320KB
-
memory/4432-373-0x000000000A1E0000-0x000000000A1FE000-memory.dmpFilesize
120KB
-
memory/4432-369-0x000000000A5E0000-0x000000000AADE000-memory.dmpFilesize
5.0MB
-
memory/4432-368-0x000000000A040000-0x000000000A0D2000-memory.dmpFilesize
584KB
-
memory/4596-200-0x0000000000000000-mapping.dmp
-
memory/4596-269-0x0000000008240000-0x00000000082B6000-memory.dmpFilesize
472KB
-
memory/4596-281-0x0000000009040000-0x000000000905A000-memory.dmpFilesize
104KB
-
memory/4596-260-0x00000000078C0000-0x0000000007926000-memory.dmpFilesize
408KB
-
memory/4596-241-0x0000000007220000-0x0000000007848000-memory.dmpFilesize
6.2MB
-
memory/4596-264-0x00000000079C0000-0x00000000079DC000-memory.dmpFilesize
112KB
-
memory/4596-265-0x0000000007FE0000-0x000000000802B000-memory.dmpFilesize
300KB
-
memory/4596-236-0x0000000004A80000-0x0000000004AB6000-memory.dmpFilesize
216KB
-
memory/4596-280-0x0000000009920000-0x0000000009F98000-memory.dmpFilesize
6.5MB
-
memory/4596-261-0x0000000007930000-0x0000000007996000-memory.dmpFilesize
408KB