Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
25-07-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
Document.pdf.scr
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
Document.pdf.scr
Resource
win10-20220722-en
Behavioral task
behavioral3
Sample
Document.pdf.scr
Resource
win10v2004-20220721-en
General
-
Target
Document.pdf.scr
-
Size
700.0MB
-
MD5
ea7b8236ca438995b2ee7604043fc20c
-
SHA1
4543d6fbe467c8a17b962e0c19a25fd59d82ded8
-
SHA256
954e35d28e5938766eb6922e08a4e26d5ed892a1578027374d945efbe0d927e3
-
SHA512
22a1173def10e7c74fbcef024127f87635a508044c4fbbfa2f4e32b05823b5fc9fa166645851dbaa32c926a735745ca727dc0183a72fd9f3cc222f9f07395a7a
Malware Config
Extracted
redline
1
62.204.41.139:25190
-
auth_value
2c239ad7c28c8eab1f9626557bb9457a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1280-297-0x000000000041ADB2-mapping.dmp family_redline behavioral2/memory/1280-334-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 3932 set thread context of 1280 3932 Document.pdf.scr AppLaunch.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
powershell.exeDocument.pdf.scrAppLaunch.exetaskmgr.exepid process 5112 powershell.exe 5112 powershell.exe 5112 powershell.exe 3932 Document.pdf.scr 3932 Document.pdf.scr 1280 AppLaunch.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Document.pdf.scrpowershell.exeAppLaunch.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 3932 Document.pdf.scr Token: SeDebugPrivilege 5112 powershell.exe Token: SeDebugPrivilege 1280 AppLaunch.exe Token: SeDebugPrivilege 2148 taskmgr.exe Token: SeSystemProfilePrivilege 2148 taskmgr.exe Token: SeCreateGlobalPrivilege 2148 taskmgr.exe Token: 33 2148 taskmgr.exe Token: SeIncBasePriorityPrivilege 2148 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
Processes:
taskmgr.exepid process 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
Processes:
taskmgr.exepid process 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe 2148 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 3932 wrote to memory of 5112 3932 Document.pdf.scr powershell.exe PID 3932 wrote to memory of 5112 3932 Document.pdf.scr powershell.exe PID 3932 wrote to memory of 5112 3932 Document.pdf.scr powershell.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe PID 3932 wrote to memory of 1280 3932 Document.pdf.scr AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-297-0x000000000041ADB2-mapping.dmp
-
memory/1280-334-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1280-355-0x0000000009290000-0x0000000009896000-memory.dmpFilesize
6.0MB
-
memory/1280-356-0x0000000001250000-0x0000000001262000-memory.dmpFilesize
72KB
-
memory/1280-357-0x0000000008D90000-0x0000000008E9A000-memory.dmpFilesize
1.0MB
-
memory/1280-651-0x000000000C770000-0x000000000CC9C000-memory.dmpFilesize
5.2MB
-
memory/1280-650-0x000000000A9A0000-0x000000000AB62000-memory.dmpFilesize
1.8MB
-
memory/1280-387-0x000000000B0F0000-0x000000000B140000-memory.dmpFilesize
320KB
-
memory/1280-385-0x0000000009F50000-0x0000000009F6E000-memory.dmpFilesize
120KB
-
memory/1280-381-0x0000000009CA0000-0x0000000009D32000-memory.dmpFilesize
584KB
-
memory/1280-378-0x0000000009FA0000-0x000000000A49E000-memory.dmpFilesize
5.0MB
-
memory/1280-362-0x0000000008D00000-0x0000000008D4B000-memory.dmpFilesize
300KB
-
memory/1280-360-0x0000000008CC0000-0x0000000008CFE000-memory.dmpFilesize
248KB
-
memory/3932-168-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-174-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-137-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-138-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-139-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-140-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-141-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-142-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-143-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-144-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-145-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-146-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-147-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-148-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-149-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-150-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-151-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-152-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-153-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-154-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-155-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-156-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-157-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-158-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-159-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-160-0x0000000000800000-0x0000000000A26000-memory.dmpFilesize
2.1MB
-
memory/3932-161-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-162-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-163-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-164-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-165-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-166-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-167-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-135-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-169-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-170-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-171-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-172-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-173-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-136-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-175-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-176-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-177-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-178-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-179-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-180-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-181-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-182-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-183-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-184-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-185-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-186-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-187-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-188-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-189-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-190-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-191-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-195-0x0000000005B60000-0x0000000005BC2000-memory.dmpFilesize
392KB
-
memory/3932-196-0x0000000005C40000-0x0000000005CD2000-memory.dmpFilesize
584KB
-
memory/3932-197-0x0000000005D30000-0x0000000005D52000-memory.dmpFilesize
136KB
-
memory/3932-199-0x0000000005D60000-0x00000000060B0000-memory.dmpFilesize
3.3MB
-
memory/3932-127-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-128-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-129-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-130-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-131-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-134-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-133-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/3932-132-0x00000000774D0000-0x000000007765E000-memory.dmpFilesize
1.6MB
-
memory/5112-271-0x0000000007480000-0x00000000074E6000-memory.dmpFilesize
408KB
-
memory/5112-270-0x0000000007230000-0x0000000007296000-memory.dmpFilesize
408KB
-
memory/5112-251-0x0000000006AD0000-0x00000000070F8000-memory.dmpFilesize
6.2MB
-
memory/5112-246-0x00000000040C0000-0x00000000040F6000-memory.dmpFilesize
216KB
-
memory/5112-210-0x0000000000000000-mapping.dmp
-
memory/5112-274-0x0000000007360000-0x000000000737C000-memory.dmpFilesize
112KB
-
memory/5112-275-0x0000000007960000-0x00000000079AB000-memory.dmpFilesize
300KB
-
memory/5112-279-0x0000000007BF0000-0x0000000007C66000-memory.dmpFilesize
472KB
-
memory/5112-290-0x0000000009470000-0x0000000009AE8000-memory.dmpFilesize
6.5MB
-
memory/5112-291-0x0000000008C20000-0x0000000008C3A000-memory.dmpFilesize
104KB