Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2023 03:58

General

  • Target

    0x000700000001414c-78.exe

  • Size

    173KB

  • MD5

    80b8e7619bf7ee3336ae66fb0b1a4839

  • SHA1

    2d7d7a69f4e24746fe836eeb5c885c08b7969e62

  • SHA256

    d7b166f6b81acac6a9b87d4e46b0b83db5270e831d728ab70b6c2dbd13263a5f

  • SHA512

    1cda820a65cbb5a1e18f0fd4905ae52a0af6e2dbc77c7ea62b1e3fae359d3de3279126673b94579ab51739a6a4fbeb80ed630eb9e81ba4eec7528c7918549774

  • SSDEEP

    3072:crbYm66HKzLSFYuxN4eCeWC/qUq8e8hh:ObYn/SelW/qUq

Malware Config

Extracted

Family

redline

Botnet

dast

C2

83.97.73.129:19068

Attributes
  • auth_value

    17d71bf1a3f93284f5848e00b0dd8222

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000700000001414c-78.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000700000001414c-78.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:628

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/628-133-0x0000000000950000-0x0000000000980000-memory.dmp
    Filesize

    192KB

  • memory/628-134-0x0000000005A80000-0x0000000006098000-memory.dmp
    Filesize

    6.1MB

  • memory/628-135-0x0000000005570000-0x000000000567A000-memory.dmp
    Filesize

    1.0MB

  • memory/628-136-0x00000000052B0000-0x00000000052C2000-memory.dmp
    Filesize

    72KB

  • memory/628-137-0x0000000005350000-0x0000000005360000-memory.dmp
    Filesize

    64KB

  • memory/628-138-0x0000000005310000-0x000000000534C000-memory.dmp
    Filesize

    240KB

  • memory/628-139-0x0000000005350000-0x0000000005360000-memory.dmp
    Filesize

    64KB

  • memory/628-140-0x0000000005990000-0x0000000005A06000-memory.dmp
    Filesize

    472KB

  • memory/628-141-0x0000000006140000-0x00000000061D2000-memory.dmp
    Filesize

    584KB

  • memory/628-142-0x0000000006B40000-0x00000000070E4000-memory.dmp
    Filesize

    5.6MB

  • memory/628-143-0x00000000060A0000-0x0000000006106000-memory.dmp
    Filesize

    408KB

  • memory/628-144-0x0000000006960000-0x0000000006B22000-memory.dmp
    Filesize

    1.8MB

  • memory/628-145-0x0000000008D10000-0x000000000923C000-memory.dmp
    Filesize

    5.2MB

  • memory/628-146-0x0000000006820000-0x0000000006870000-memory.dmp
    Filesize

    320KB