Analysis

  • max time kernel
    128s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2023, 07:42

General

  • Target

    2096-59-0x0000000004020000-0x0000000004054000-memory.exe

  • Size

    208KB

  • MD5

    2026b90958836385354b196dd140e536

  • SHA1

    4248362cdb50e9751cb7feb562cbdf7f8108a483

  • SHA256

    4dc85576b87099b35439fda20d4774f74b7861c7e0e48817b230e58891e82622

  • SHA512

    34d73c5986a5939fd1edb6140d68ef8c81ba04fb4cb02e540b6d73268e6ad918d033e1a1f2ced9ff72b08abe1ce2cd6c555183a5f2839547c952404f8d07fd23

  • SSDEEP

    3072:brrs690Gg877NFEk42BufCdNXOvwenR2hO2m4+wGze+z8e8hB:nrs6k877zNOoenR2o2mvJ

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

178.32.90.250:29608

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2096-59-0x0000000004020000-0x0000000004054000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2096-59-0x0000000004020000-0x0000000004054000-memory.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1828-133-0x00000000008B0000-0x00000000008E4000-memory.dmp

    Filesize

    208KB

  • memory/1828-134-0x0000000074CD0000-0x0000000075480000-memory.dmp

    Filesize

    7.7MB

  • memory/1828-135-0x00000000059F0000-0x0000000006008000-memory.dmp

    Filesize

    6.1MB

  • memory/1828-136-0x00000000054E0000-0x00000000055EA000-memory.dmp

    Filesize

    1.0MB

  • memory/1828-137-0x0000000005270000-0x0000000005282000-memory.dmp

    Filesize

    72KB

  • memory/1828-138-0x00000000052C0000-0x00000000052D0000-memory.dmp

    Filesize

    64KB

  • memory/1828-139-0x0000000005410000-0x000000000544C000-memory.dmp

    Filesize

    240KB

  • memory/1828-140-0x00000000056F0000-0x0000000005766000-memory.dmp

    Filesize

    472KB

  • memory/1828-141-0x0000000005810000-0x00000000058A2000-memory.dmp

    Filesize

    584KB

  • memory/1828-142-0x0000000006AB0000-0x0000000007054000-memory.dmp

    Filesize

    5.6MB

  • memory/1828-143-0x0000000006010000-0x0000000006076000-memory.dmp

    Filesize

    408KB

  • memory/1828-144-0x0000000074CD0000-0x0000000075480000-memory.dmp

    Filesize

    7.7MB

  • memory/1828-145-0x0000000006800000-0x00000000069C2000-memory.dmp

    Filesize

    1.8MB

  • memory/1828-146-0x0000000008C80000-0x00000000091AC000-memory.dmp

    Filesize

    5.2MB

  • memory/1828-147-0x00000000052C0000-0x00000000052D0000-memory.dmp

    Filesize

    64KB

  • memory/1828-148-0x0000000006A40000-0x0000000006A90000-memory.dmp

    Filesize

    320KB

  • memory/1828-150-0x0000000074CD0000-0x0000000075480000-memory.dmp

    Filesize

    7.7MB