Analysis

  • max time kernel
    118s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2023, 12:58

General

  • Target

    COD warzone aimbot+wallhack.exe

  • Size

    734.4MB

  • MD5

    3bbe3890090436d672cb607c0ac51d15

  • SHA1

    871588b00e89787c0c578fef854f0eb17131c5c2

  • SHA256

    b6da030f790e7056b5cf054da861510f68105b0ce9263a2d43f312869ca4ec9d

  • SHA512

    3785cd391038e8479e4fd79d9f492365ee2c4f049dba493b2c84f289065dff740cb732ebaab22e8e5831769c50ea4b183ef3c0e7b1f824dc9ba98b684375f99f

  • SSDEEP

    12582912:QQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyQyq:Qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnq

Malware Config

Extracted

Family

redline

Botnet

top zaliv4

C2

116.203.249.207:34832

Attributes
  • auth_value

    4a417404710247a2f29e435a0a05e4c0

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\COD warzone aimbot+wallhack.exe
    "C:\Users\Admin\AppData\Local\Temp\COD warzone aimbot+wallhack.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4248

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2668-133-0x0000000000F70000-0x0000000001178000-memory.dmp

    Filesize

    2.0MB

  • memory/2668-134-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-135-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-137-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-139-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-141-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-143-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-145-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-147-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-149-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-150-0x000000001BD60000-0x000000001BD70000-memory.dmp

    Filesize

    64KB

  • memory/2668-152-0x00000000017C0000-0x00000000017C1000-memory.dmp

    Filesize

    4KB

  • memory/2668-155-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-153-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-157-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-159-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-161-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-163-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-165-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-167-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-169-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-171-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-173-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-175-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-177-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-179-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-181-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-183-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-185-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-187-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-189-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-191-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-193-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-195-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-197-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-199-0x00000000031A0000-0x000000000321E000-memory.dmp

    Filesize

    504KB

  • memory/2668-200-0x0000000003220000-0x0000000003221000-memory.dmp

    Filesize

    4KB

  • memory/4248-203-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4248-204-0x000000000B9A0000-0x000000000BFB8000-memory.dmp

    Filesize

    6.1MB

  • memory/4248-205-0x000000000D370000-0x000000000D47A000-memory.dmp

    Filesize

    1.0MB

  • memory/4248-206-0x000000000D290000-0x000000000D2A2000-memory.dmp

    Filesize

    72KB

  • memory/4248-207-0x00000000057C0000-0x00000000057D0000-memory.dmp

    Filesize

    64KB

  • memory/4248-208-0x000000000D2F0000-0x000000000D32C000-memory.dmp

    Filesize

    240KB

  • memory/4248-209-0x000000000DE60000-0x000000000DED6000-memory.dmp

    Filesize

    472KB

  • memory/4248-210-0x000000000DF80000-0x000000000E012000-memory.dmp

    Filesize

    584KB

  • memory/4248-211-0x000000000E5D0000-0x000000000EB74000-memory.dmp

    Filesize

    5.6MB

  • memory/4248-212-0x000000000E020000-0x000000000E086000-memory.dmp

    Filesize

    408KB

  • memory/4248-213-0x000000000DF30000-0x000000000DF80000-memory.dmp

    Filesize

    320KB

  • memory/4248-214-0x000000000F1E0000-0x000000000F3A2000-memory.dmp

    Filesize

    1.8MB

  • memory/4248-215-0x000000000F8E0000-0x000000000FE0C000-memory.dmp

    Filesize

    5.2MB

  • memory/4248-216-0x00000000057C0000-0x00000000057D0000-memory.dmp

    Filesize

    64KB