Analysis

  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2023 09:15

General

  • Target

    0x000700000001273a-93.exe

  • Size

    168KB

  • MD5

    ccd8784f2f12e55d741970aa1536ea01

  • SHA1

    bc016065f4bd90669d12563b2106c98e29fde54a

  • SHA256

    786e606e66262e2ed1bc3b444f55c7b22d18ba09b569279a9103266031180a66

  • SHA512

    0f7fbb9f67ea536b9c0ff71180d4fec78819745bfa16ff8d50602327aa26148ec6d60d3e328a2a1523a3c7c5ab971cabe7804b776c510d5d1afc92f1b19c28eb

  • SSDEEP

    3072:4UUfOJD8WDEpxKvmE1xqVOM0Xa3ODL0Ht8e8hp:lkOLEpWLd/QODL0Ht

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19046

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000700000001273a-93.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000700000001273a-93.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2024-54-0x00000000013A0000-0x00000000013CE000-memory.dmp

    Filesize

    184KB

  • memory/2024-55-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2024-56-0x0000000000FC0000-0x0000000001000000-memory.dmp

    Filesize

    256KB