Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2022 10:13
Behavioral task
behavioral1
Sample
Document.pdf.scr
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Document.pdf.scr
Resource
win10v2004-20220812-en
General
-
Target
Document.pdf.scr
-
Size
700.0MB
-
MD5
42a123d2a8c6b9bf813d4ba30c6f7339
-
SHA1
020db224e295b652601f34b1b5284f3ad6bdf22f
-
SHA256
4e5b72658b3ee150f255b726931d387e897d1e5db4f40fbd6a3181e1908671af
-
SHA512
aec4d9c6c9255ad4764a737bb38f68e525d95d38d634e286100c896683fa1bc5f3b62cdc829b6f990fb2570455a6f1c3a7c81e117499065520c24325700cccaf
-
SSDEEP
98304:Xm27HCFxPcIIqb9tIKdgEezl6nW1WIxV2UBPB3VsYT:XmHbPcIIqb9u15zl6nW1WA2rYT
Malware Config
Extracted
redline
web
62.204.41.139:25190
-
auth_value
2b0495835b75f494572b5792f0b7a9e1
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3068-143-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Document.pdf.scrdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Document.pdf.scr -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2084-132-0x0000000000490000-0x00000000008DC000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 2084 set thread context of 3068 2084 Document.pdf.scr InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeDocument.pdf.scrpid process 4752 powershell.exe 4752 powershell.exe 2084 Document.pdf.scr 2084 Document.pdf.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeDocument.pdf.scrdescription pid process Token: SeDebugPrivilege 4752 powershell.exe Token: SeDebugPrivilege 2084 Document.pdf.scr -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Document.pdf.scrdescription pid process target process PID 2084 wrote to memory of 4752 2084 Document.pdf.scr powershell.exe PID 2084 wrote to memory of 4752 2084 Document.pdf.scr powershell.exe PID 2084 wrote to memory of 4752 2084 Document.pdf.scr powershell.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe PID 2084 wrote to memory of 3068 2084 Document.pdf.scr InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Document.pdf.scr" /S1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2084-133-0x0000000005430000-0x0000000005452000-memory.dmpFilesize
136KB
-
memory/2084-132-0x0000000000490000-0x00000000008DC000-memory.dmpFilesize
4.3MB
-
memory/3068-142-0x0000000000000000-mapping.dmp
-
memory/3068-147-0x0000000007BE0000-0x0000000007C1C000-memory.dmpFilesize
240KB
-
memory/3068-146-0x0000000007B80000-0x0000000007B92000-memory.dmpFilesize
72KB
-
memory/3068-145-0x0000000007C70000-0x0000000007D7A000-memory.dmpFilesize
1.0MB
-
memory/3068-144-0x00000000062A0000-0x00000000068B8000-memory.dmpFilesize
6.1MB
-
memory/3068-143-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4752-136-0x0000000005190000-0x00000000057B8000-memory.dmpFilesize
6.2MB
-
memory/4752-140-0x00000000075A0000-0x0000000007C1A000-memory.dmpFilesize
6.5MB
-
memory/4752-141-0x0000000006400000-0x000000000641A000-memory.dmpFilesize
104KB
-
memory/4752-139-0x0000000005F20000-0x0000000005F3E000-memory.dmpFilesize
120KB
-
memory/4752-138-0x00000000058E0000-0x0000000005946000-memory.dmpFilesize
408KB
-
memory/4752-137-0x0000000005870000-0x00000000058D6000-memory.dmpFilesize
408KB
-
memory/4752-135-0x0000000002930000-0x0000000002966000-memory.dmpFilesize
216KB
-
memory/4752-134-0x0000000000000000-mapping.dmp