Analysis
-
max time kernel
27s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
03/01/2023, 01:21
General
-
Target
UniverseCity.exe
-
Size
816.3MB
-
MD5
9292518dbea741c7ef6b0e4dd46d7692
-
SHA1
c30e4be196eceff64068ac026e6a462748f1ceb2
-
SHA256
83974beea0b42d1473dfd2d9ce8c60818f94bf356fa8d3b9bba836963b530985
-
SHA512
d0f9ffc262754357e349f1bb9736e3a7e9e006740c83a0c79b91fc218e5d1486d53eadc524f2829bdfa6145ac7cd907bea5c669d1bf0b5cca7afac93fd5c8e00
-
SSDEEP
98304:4w6Tks8Ip9y88/gE1k8cIjNnoeXsU11HK3rt2avguB4et/vEw4KLOqcCLj1J1cNE:47Tks8I78bkKjNnjsU11g
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UniverseCity100
C2
80.89.228.168:5007
Attributes
-
auth_value
a16f64012f1825f5b9cc033dc35b580f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UniverseCity.exe"C:\Users\Admin\AppData\Local\Temp\UniverseCity.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
8KB
-
Filesize
7.6MB
-
Filesize
3.1MB