Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15/02/2023, 15:27

General

  • Target

    tmp.exe

  • Size

    175KB

  • MD5

    ce5ef6aac94fdb2af40da676f6cab58f

  • SHA1

    c393f24b1550955a686ee39067f20813415af95f

  • SHA256

    ce360295ca7fcc1a1c2b47a604305c67ab41358770edbd769a6a44aa635c2fd0

  • SHA512

    2cc98869cba6a962129c57fb7e3ff0b64623c94903bfbf9a2648e191b633fbe73f8e7b9d8fea348e30cc88bc44d27454fd880c81a55a6b795170fa804e6cda65

  • SSDEEP

    3072:9xqZWFFa7E6T8mAje3595hUfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+ct:HqZc1q5h

Malware Config

Extracted

Family

redline

Botnet

cr10n

C2

176.113.115.17:4132

Attributes
  • auth_value

    6016c19179aa1044c369adb0ec1f363b

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:856

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/856-54-0x0000000001090000-0x00000000010C2000-memory.dmp

          Filesize

          200KB

        • memory/856-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

          Filesize

          8KB