Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
26-05-2023 01:12
General
-
Target
0ddc014253ceb9c658293f63d13c7861b58f193f5aa26efa79e2b351329f62c5.exe
-
Size
318KB
-
MD5
5c613701ca3e08dcb8ae0149a566b373
-
SHA1
fd2e03d8ab5c2abc313ab1a8e478d6dffbd580ba
-
SHA256
0ddc014253ceb9c658293f63d13c7861b58f193f5aa26efa79e2b351329f62c5
-
SHA512
489bea9fba294435ec4fafd96469c0a992f6531119aa3a924ea2226a5e8cd3adad016fe32dee31069184358e8b2f7e6bf15511082ec8dd8df95b32dcda095fd2
-
SSDEEP
6144:vXm6c0jxX1ncjAOq8Jd66pPogu/StFghATFZkHA10Zb6ZI:/PFnc8b8TwguEGA371B
Malware Config
Extracted
redline
LogsDiller Cloud (Telegram: @logsdillabot)
51.210.170.199:23368
-
auth_value
c2955ed3813a798683a185a82e949f88
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ddc014253ceb9c658293f63d13c7861b58f193f5aa26efa79e2b351329f62c5.exe"C:\Users\Admin\AppData\Local\Temp\0ddc014253ceb9c658293f63d13c7861b58f193f5aa26efa79e2b351329f62c5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
184KB
-
Filesize
240KB
-
Filesize
256KB
-
Filesize
2.6MB
-
Filesize
2.6MB