Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2023, 16:37

General

  • Target

    0x000900000001af27-199.exe

  • Size

    176KB

  • MD5

    f528a645683dc5c95b584545b53a921a

  • SHA1

    0d896fa5b92d30dfb27c83579711c0e8423f5d65

  • SHA256

    e7733bb8b8fdcb5cccbfcf411c162c10e0871a30e69c35fbf572ecceab410be7

  • SHA512

    c9a016771d86c44b20a0b3443b0f5c8f3367b43e565022768bc5ebae56e14f78a48bc3e8a189b6ac466542d8979231a0e7999378d85e2b04e5d16c5374ffd03c

  • SSDEEP

    3072:BxqZW11a2kX8fkRyeiBWep3FhhFvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOf:zqZkkgN1hh

Malware Config

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000900000001af27-199.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000900000001af27-199.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1520-54-0x0000000001160000-0x0000000001192000-memory.dmp

    Filesize

    200KB

  • memory/1520-55-0x00000000046B0000-0x00000000046F0000-memory.dmp

    Filesize

    256KB