Overview

overview

10

Static

static

7

Document.pdf.scr

windows7-x64

10

Resubmissions

22-09-2022 09:08

220922-k32v4sahh9 10

22-09-2022 09:02

220922-kzq97sefer 10

22-09-2022 08:41

220922-kly3wsagc3 10

Analysis

  • max time kernel
    119s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20220901-de
  • resource tags

    arch:x64arch:x86image:win7-20220901-delocale:de-deos:windows7-x64systemwindows
  • submitted
    22-09-2022 09:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document.pdf.scr

  • Size

    700.0MB

  • MD5

    42a123d2a8c6b9bf813d4ba30c6f7339

  • SHA1

    020db224e295b652601f34b1b5284f3ad6bdf22f

  • SHA256

    4e5b72658b3ee150f255b726931d387e897d1e5db4f40fbd6a3181e1908671af

  • SHA512

    aec4d9c6c9255ad4764a737bb38f68e525d95d38d634e286100c896683fa1bc5f3b62cdc829b6f990fb2570455a6f1c3a7c81e117499065520c24325700cccaf

  • SSDEEP

    98304:Xm27HCFxPcIIqb9tIKdgEezl6nW1WIxV2UBPB3VsYT:XmHbPcIIqb9u15zl6nW1WA2rYT

Score
10/10
redlinewebagilenetinfostealer

Malware Config

Extracted

Family

redline

Botnet

web

C2

62.204.41.139:25190

Attributes
  • auth_value

    2b0495835b75f494572b5792f0b7a9e1

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 7 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr
    "C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:516
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:604

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/516-68-0x000000000042223A-mapping.dmp
      Download
    • memory/516-67-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/516-63-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/516-65-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/516-72-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/516-70-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/516-66-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/516-62-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

      Download
    • memory/604-77-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/604-74-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/604-75-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/604-76-0x0000000140000000-0x00000001405E8000-memory.dmp
      Filesize

      5.9MB

      Download
    • memory/1712-55-0x0000000000DD0000-0x0000000000E88000-memory.dmp
      Filesize

      736KB

      Download
    • memory/1712-56-0x0000000075F81000-0x0000000075F83000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1712-54-0x0000000000130000-0x000000000057C000-memory.dmp
      Filesize

      4.3MB

      Download
    • memory/1712-57-0x0000000004B50000-0x0000000004BE2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1800-61-0x000000006FF70000-0x000000007051B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1800-60-0x000000006FF70000-0x000000007051B000-memory.dmp
      Filesize

      5.7MB

      Download
    • memory/1800-58-0x0000000000000000-mapping.dmp
      Download