Analysis

  • max time kernel
    4294180s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    12-04-2022 19:02

General

  • Target

    115cc65e91a90be872ac728e0e377d86.exe

  • Size

    363KB

  • MD5

    115cc65e91a90be872ac728e0e377d86

  • SHA1

    f975b56f9b3edcfe318e889a33ef24031cc26570

  • SHA256

    8930f6f934a64dcf090b74709b4ea5863559adf17ac180cca74eaa06d7e1c22d

  • SHA512

    de399be5769dbfeb51b0abff35e6e67b5ef59a81b335918cf1ee701c907c0e476b7f067f7646b4ab71e6b01cc071773ef94f3d2d01141b67959c356cf4ddca9f

Malware Config

Extracted

Family

redline

Botnet

50

C2

193.106.191.153:23196

Attributes
  • auth_value

    8735fcb130c82dd9d353478678d60bde

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\115cc65e91a90be872ac728e0e377d86.exe
    "C:\Users\Admin\AppData\Local\Temp\115cc65e91a90be872ac728e0e377d86.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1748

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1748-54-0x0000000000618000-0x0000000000642000-memory.dmp

    Filesize

    168KB

  • memory/1748-55-0x0000000000618000-0x0000000000642000-memory.dmp

    Filesize

    168KB

  • memory/1748-56-0x0000000000220000-0x0000000000257000-memory.dmp

    Filesize

    220KB

  • memory/1748-57-0x0000000000400000-0x0000000000484000-memory.dmp

    Filesize

    528KB

  • memory/1748-58-0x00000000007E0000-0x0000000000810000-memory.dmp

    Filesize

    192KB

  • memory/1748-59-0x0000000000810000-0x000000000083E000-memory.dmp

    Filesize

    184KB

  • memory/1748-60-0x0000000004B54000-0x0000000004B56000-memory.dmp

    Filesize

    8KB