Analysis
-
max time kernel
452s -
max time network
475s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 17:27
Static task
static1
Behavioral task
behavioral1
Sample
hotel-requirements.pdf/hotel-requirements.pdf.scr
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
hotel-requirements.pdf/hotel-requirements.pdf.scr
Resource
win10v2004-20230621-en
General
-
Target
hotel-requirements.pdf/hotel-requirements.pdf.scr
-
Size
564.4MB
-
MD5
7faa29f9a965143cf67f27c1455111c1
-
SHA1
f5c34c4399c2fca31c6ac05e14a566374c6732a9
-
SHA256
a06612c8c0ff60c840da39e7d8571e949716bdec4c4a6582fdaae25216907fbe
-
SHA512
2caffe5412262a291fa76a5887ccff316b3983a675a16d97c4dcde087ae3d3ccdb9685f66dbc999d1ade1888d6df45d015e1dd9bc0d396a2abf8761949bf3dd6
-
SSDEEP
786432:MA5OgdnGFPsX2YiMiqN7z5EYUj4Vtpe9oA4Jxo88nvcVkf/2npG4U:M4d2oiU7z5EZMre9GJxo8q0Vkf8a
Malware Config
Extracted
redline
Mastif
78.47.242.225:15635
-
auth_value
32b21fb55370c8e21f0f75577471534e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 10 1100 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
Installer-Wizard_v1.4o.7n.exepid process 4292 Installer-Wizard_v1.4o.7n.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs
Processes:
powershell.exepid process 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1100 set thread context of 4184 1100 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepid process 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe 1100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 1100 powershell.exe Token: SeShutdownPrivilege 1100 powershell.exe Token: SeCreatePagefilePrivilege 1100 powershell.exe Token: SeDebugPrivilege 4184 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
hotel-requirements.pdf.scrInstaller-Wizard_v1.4o.7n.exepowershell.exedescription pid process target process PID 5004 wrote to memory of 4292 5004 hotel-requirements.pdf.scr Installer-Wizard_v1.4o.7n.exe PID 5004 wrote to memory of 4292 5004 hotel-requirements.pdf.scr Installer-Wizard_v1.4o.7n.exe PID 5004 wrote to memory of 4292 5004 hotel-requirements.pdf.scr Installer-Wizard_v1.4o.7n.exe PID 4292 wrote to memory of 1100 4292 Installer-Wizard_v1.4o.7n.exe powershell.exe PID 4292 wrote to memory of 1100 4292 Installer-Wizard_v1.4o.7n.exe powershell.exe PID 4292 wrote to memory of 1100 4292 Installer-Wizard_v1.4o.7n.exe powershell.exe PID 1100 wrote to memory of 4952 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4952 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4952 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe PID 1100 wrote to memory of 4184 1100 powershell.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hotel-requirements.pdf\hotel-requirements.pdf.scr"C:\Users\Admin\AppData\Local\Temp\hotel-requirements.pdf\hotel-requirements.pdf.scr" /S1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Installer-Wizard_v1.4o.7n\Installer-Wizard_v1.4o.7n.exe"C:\Users\Admin\AppData\Local\Temp\Installer-Wizard_v1.4o.7n\Installer-Wizard_v1.4o.7n.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Installer-Wizard_v1.4o.7n\Installer-Wizard_v1.4o.7n.exeFilesize
74.3MB
MD54ca5ed9d8c94d36e9291d79f98194dc2
SHA1de70cc4d3bcc448c092c5bd99ee661373f76383d
SHA2565877e8427328cf96115d79d42767fa65c4b54212a0ade9becb8effbc8d3b7074
SHA512d8552f61a3de0170ca5002b02b64dd6a9ab613c8e49b292f310596e52042534fc6b6cb03a71cd63fb9ff8234dd4ff46313b59f29db26e3043af078e6674caded
-
C:\Users\Admin\AppData\Local\Temp\Installer-Wizard_v1.4o.7n\Installer-Wizard_v1.4o.7n.exeFilesize
74.3MB
MD54ca5ed9d8c94d36e9291d79f98194dc2
SHA1de70cc4d3bcc448c092c5bd99ee661373f76383d
SHA2565877e8427328cf96115d79d42767fa65c4b54212a0ade9becb8effbc8d3b7074
SHA512d8552f61a3de0170ca5002b02b64dd6a9ab613c8e49b292f310596e52042534fc6b6cb03a71cd63fb9ff8234dd4ff46313b59f29db26e3043af078e6674caded
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2csicxd0.c1s.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1100-162-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-171-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-184-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-175-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-163-0x0000000007A20000-0x000000000809A000-memory.dmpFilesize
6.5MB
-
memory/1100-144-0x00000000050B0000-0x00000000056D8000-memory.dmpFilesize
6.2MB
-
memory/1100-145-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-164-0x00000000073A0000-0x00000000073BA000-memory.dmpFilesize
104KB
-
memory/1100-147-0x0000000005020000-0x0000000005042000-memory.dmpFilesize
136KB
-
memory/1100-166-0x00000000080D0000-0x00000000080F2000-memory.dmpFilesize
136KB
-
memory/1100-149-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB
-
memory/1100-168-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-159-0x0000000006010000-0x000000000602E000-memory.dmpFilesize
120KB
-
memory/1100-160-0x0000000006560000-0x00000000065A4000-memory.dmpFilesize
272KB
-
memory/1100-161-0x0000000007320000-0x0000000007396000-memory.dmpFilesize
472KB
-
memory/1100-167-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-143-0x0000000004A40000-0x0000000004A76000-memory.dmpFilesize
216KB
-
memory/1100-146-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1100-148-0x0000000005850000-0x00000000058B6000-memory.dmpFilesize
408KB
-
memory/4184-172-0x0000000017F20000-0x0000000017F32000-memory.dmpFilesize
72KB
-
memory/4184-173-0x0000000018050000-0x000000001815A000-memory.dmpFilesize
1.0MB
-
memory/4184-180-0x000000001AB80000-0x000000001B0AC000-memory.dmpFilesize
5.2MB
-
memory/4184-169-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4184-170-0x0000000018480000-0x0000000018A98000-memory.dmpFilesize
6.1MB
-
memory/4184-179-0x0000000019B70000-0x0000000019D32000-memory.dmpFilesize
1.8MB
-
memory/4184-177-0x0000000019200000-0x0000000019250000-memory.dmpFilesize
320KB
-
memory/4184-176-0x0000000018F40000-0x0000000018F5E000-memory.dmpFilesize
120KB
-
memory/4184-174-0x0000000017F80000-0x0000000017FBC000-memory.dmpFilesize
240KB
-
memory/4292-142-0x000000000A2A0000-0x000000000A2AA000-memory.dmpFilesize
40KB
-
memory/4292-138-0x0000000000DE0000-0x0000000005826000-memory.dmpFilesize
74.3MB
-
memory/4292-140-0x000000000A1D0000-0x000000000A262000-memory.dmpFilesize
584KB
-
memory/4292-165-0x000000000A180000-0x000000000A190000-memory.dmpFilesize
64KB
-
memory/4292-139-0x000000000A880000-0x000000000AE24000-memory.dmpFilesize
5.6MB
-
memory/4292-141-0x000000000A180000-0x000000000A190000-memory.dmpFilesize
64KB