Analysis

  • max time kernel
    136s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-06-2023 08:22

General

  • Target

    02056799.exe

  • Size

    173KB

  • MD5

    867df6a9ae491302ab2d85bcda63c3f2

  • SHA1

    e3874a2627de51f318b12705a4976eed2c072df3

  • SHA256

    0eed693f84bbb017e35edc633b636255e3539a35a3b9f5482da0754b98f91457

  • SHA512

    6d5b81ec26b98acd40e94ff126c55da54a67ab2c3b8058c0f7bb25229fc662ff189da911b478b3dfb60a7272f170864bf01decc12ff86fa34726dc2f2aa9590b

  • SSDEEP

    3072:crbYm66HKzLSFYuxN4eCeWC/qUq8e8hh:ObYn/SelW/qUq

Malware Config

Extracted

Family

redline

Botnet

dast

C2

83.97.73.129:19068

Attributes
  • auth_value

    17d71bf1a3f93284f5848e00b0dd8222

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\02056799.exe
    "C:\Users\Admin\AppData\Local\Temp\02056799.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4104

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4104-133-0x0000000000010000-0x0000000000040000-memory.dmp
    Filesize

    192KB

  • memory/4104-134-0x000000000A4D0000-0x000000000AAE8000-memory.dmp
    Filesize

    6.1MB

  • memory/4104-135-0x0000000009FC0000-0x000000000A0CA000-memory.dmp
    Filesize

    1.0MB

  • memory/4104-136-0x0000000009ED0000-0x0000000009EE2000-memory.dmp
    Filesize

    72KB

  • memory/4104-137-0x0000000004A20000-0x0000000004A30000-memory.dmp
    Filesize

    64KB

  • memory/4104-138-0x0000000009F30000-0x0000000009F6C000-memory.dmp
    Filesize

    240KB

  • memory/4104-139-0x000000000A230000-0x000000000A2A6000-memory.dmp
    Filesize

    472KB

  • memory/4104-140-0x000000000A350000-0x000000000A3E2000-memory.dmp
    Filesize

    584KB

  • memory/4104-141-0x000000000A2B0000-0x000000000A316000-memory.dmp
    Filesize

    408KB

  • memory/4104-142-0x0000000004A20000-0x0000000004A30000-memory.dmp
    Filesize

    64KB

  • memory/4104-143-0x000000000B4A0000-0x000000000BA44000-memory.dmp
    Filesize

    5.6MB

  • memory/4104-144-0x000000000B1C0000-0x000000000B382000-memory.dmp
    Filesize

    1.8MB

  • memory/4104-145-0x000000000BF80000-0x000000000C4AC000-memory.dmp
    Filesize

    5.2MB

  • memory/4104-146-0x000000000B070000-0x000000000B0C0000-memory.dmp
    Filesize

    320KB