Analysis
-
max time kernel
27s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
16-05-2023 04:26
General
-
Target
f4337002.exe
-
Size
145KB
-
MD5
ff33aa6c4e99cad5fb72272e2f012b6a
-
SHA1
0adffd5ad69984da9baf96115ebcdaea80d8e96e
-
SHA256
b79d7493e82176be25f069fd18d80e1b3849464063d79d9503f03c6150ffd4ac
-
SHA512
73a6262b4b34d436aad28b8a6597e64a658a8e411f239d71ad44ea6814fa168f58e2275dd05568658814e9dc952a566381e2c1b0fa0ed37ea2ce21b95c606c51
-
SSDEEP
3072:MV+m5c9QmRSRN8YNkMaJScaqhKZV8e8h4:MjA9BMrqhKf
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
dama
C2
185.161.248.25:4132
Attributes
-
auth_value
d8b2637e0546aea3944c251022b63e77
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4337002.exe"C:\Users\Admin\AppData\Local\Temp\f4337002.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
256KB