Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2023 05:18

General

  • Target

    0x00090000000122f5-78.exe

  • Size

    168KB

  • MD5

    e1f97c3658b29fa75a3838125c0c8078

  • SHA1

    15da3ebdf2b4971adbd9f0fc4d7e082081a06286

  • SHA256

    0d4e7759bb8523cf8c79be0e4b1a107a8a5ef02b4c60631e403687e070a73704

  • SHA512

    1a8000ca9c83f9a36ba41d64eb50248a8ec7a15ca0c01af7a6075f25e4533b61a518296e04502559ecabdece72e7284b4e02c288f32ea1e2cbd147da27b2be54

  • SSDEEP

    3072:CemQ6p8Wc6+yoIyqCqVMEODInQ6FR8e8h5:CemBY6oIyvjGnQ6FR

Malware Config

Extracted

Family

redline

Botnet

dusa

C2

83.97.73.126:19046

Attributes
  • auth_value

    ee896466545fedf9de5406175fb82de5

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00090000000122f5-78.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00090000000122f5-78.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4284

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4284-133-0x0000000000600000-0x000000000062E000-memory.dmp

    Filesize

    184KB

  • memory/4284-134-0x000000000AA50000-0x000000000B068000-memory.dmp

    Filesize

    6.1MB

  • memory/4284-135-0x000000000A550000-0x000000000A65A000-memory.dmp

    Filesize

    1.0MB

  • memory/4284-136-0x000000000A480000-0x000000000A492000-memory.dmp

    Filesize

    72KB

  • memory/4284-137-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

    Filesize

    64KB

  • memory/4284-138-0x000000000A4E0000-0x000000000A51C000-memory.dmp

    Filesize

    240KB

  • memory/4284-139-0x000000000A900000-0x000000000A976000-memory.dmp

    Filesize

    472KB

  • memory/4284-140-0x000000000B070000-0x000000000B102000-memory.dmp

    Filesize

    584KB

  • memory/4284-141-0x000000000B6C0000-0x000000000BC64000-memory.dmp

    Filesize

    5.6MB

  • memory/4284-142-0x000000000B110000-0x000000000B176000-memory.dmp

    Filesize

    408KB

  • memory/4284-143-0x000000000BE40000-0x000000000C002000-memory.dmp

    Filesize

    1.8MB

  • memory/4284-144-0x000000000C540000-0x000000000CA6C000-memory.dmp

    Filesize

    5.2MB

  • memory/4284-145-0x000000000BCB0000-0x000000000BD00000-memory.dmp

    Filesize

    320KB

  • memory/4284-146-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

    Filesize

    64KB