Analysis
-
max time kernel
87s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
Document.pdf.scr
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Document.pdf.scr
Resource
win10-20220722-en
Behavioral task
behavioral3
Sample
Document.pdf.scr
Resource
win10v2004-20220721-en
General
-
Target
Document.pdf.scr
-
Size
700.0MB
-
MD5
ea7b8236ca438995b2ee7604043fc20c
-
SHA1
4543d6fbe467c8a17b962e0c19a25fd59d82ded8
-
SHA256
954e35d28e5938766eb6922e08a4e26d5ed892a1578027374d945efbe0d927e3
-
SHA512
22a1173def10e7c74fbcef024127f87635a508044c4fbbfa2f4e32b05823b5fc9fa166645851dbaa32c926a735745ca727dc0183a72fd9f3cc222f9f07395a7a
Malware Config
Extracted
redline
1
62.204.41.139:25190
-
auth_value
2c239ad7c28c8eab1f9626557bb9457a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-66-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1700-67-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1700-68-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1700-69-0x000000000041ADB2-mapping.dmp family_redline behavioral1/memory/1700-71-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1700-73-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 904 set thread context of 1700 904 Document.pdf.scr AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
powershell.exeDocument.pdf.scrAppLaunch.exetaskmgr.exepid process 1096 powershell.exe 904 Document.pdf.scr 1700 AppLaunch.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1884 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Document.pdf.scrpowershell.exeAppLaunch.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 904 Document.pdf.scr Token: SeDebugPrivilege 1096 powershell.exe Token: SeDebugPrivilege 1700 AppLaunch.exe Token: SeDebugPrivilege 1884 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
Processes:
taskmgr.exepid process 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
Processes:
taskmgr.exepid process 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe 1884 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 904 wrote to memory of 1096 904 Document.pdf.scr powershell.exe PID 904 wrote to memory of 1096 904 Document.pdf.scr powershell.exe PID 904 wrote to memory of 1096 904 Document.pdf.scr powershell.exe PID 904 wrote to memory of 1096 904 Document.pdf.scr powershell.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe PID 904 wrote to memory of 1700 904 Document.pdf.scr AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-54-0x00000000002B0000-0x00000000004D6000-memory.dmpFilesize
2.1MB
-
memory/904-55-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/904-56-0x00000000021B0000-0x0000000002212000-memory.dmpFilesize
392KB
-
memory/904-57-0x00000000054F0000-0x0000000005582000-memory.dmpFilesize
584KB
-
memory/1096-58-0x0000000000000000-mapping.dmp
-
memory/1096-60-0x000000006FB80000-0x000000007012B000-memory.dmpFilesize
5.7MB
-
memory/1096-61-0x000000006FB80000-0x000000007012B000-memory.dmpFilesize
5.7MB
-
memory/1096-62-0x000000006FB80000-0x000000007012B000-memory.dmpFilesize
5.7MB
-
memory/1700-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1700-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1700-66-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1700-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1700-68-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1700-69-0x000000000041ADB2-mapping.dmp
-
memory/1700-71-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1700-73-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1884-75-0x000007FEFC3E1000-0x000007FEFC3E3000-memory.dmpFilesize
8KB
-
memory/1884-76-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1884-77-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1884-78-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1884-79-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB