Analysis

  • max time kernel
    94s
  • max time network
    98s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/07/2023, 11:40

General

  • Target

    67cb2ea56280aa1267015b3ac9034584d84e338ca2c7f82d4c6edc816448324a.exe

  • Size

    374KB

  • MD5

    206e8aae03dd8f2e4ffcbd02c945b90e

  • SHA1

    f7e273c9cf3436571b1fce2c4537716620663b9a

  • SHA256

    67cb2ea56280aa1267015b3ac9034584d84e338ca2c7f82d4c6edc816448324a

  • SHA512

    bba97edaeef5932c7b8d318068e4f6a4d6cec5c0795d17f496e2800b45749625d33bc2b58bb964860e594b034f636357c60dbe1497b365542a3007aae84195be

  • SSDEEP

    6144:22zZpAoVf7i0ETZtjgPIZEQdFQYupxLeK8/b3NKsVmItfA:ZfLVDi0ELFqYgxLWDdDmI

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

178.32.90.250:29608

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67cb2ea56280aa1267015b3ac9034584d84e338ca2c7f82d4c6edc816448324a.exe
    "C:\Users\Admin\AppData\Local\Temp\67cb2ea56280aa1267015b3ac9034584d84e338ca2c7f82d4c6edc816448324a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2168-121-0x00000000027B0000-0x00000000028B0000-memory.dmp

    Filesize

    1024KB

  • memory/2168-122-0x00000000026D0000-0x000000000270F000-memory.dmp

    Filesize

    252KB

  • memory/2168-123-0x0000000004200000-0x0000000004238000-memory.dmp

    Filesize

    224KB

  • memory/2168-124-0x0000000000400000-0x000000000248B000-memory.dmp

    Filesize

    32.5MB

  • memory/2168-125-0x0000000006B70000-0x0000000006B80000-memory.dmp

    Filesize

    64KB

  • memory/2168-126-0x0000000006B80000-0x000000000707E000-memory.dmp

    Filesize

    5.0MB

  • memory/2168-127-0x0000000004400000-0x0000000004434000-memory.dmp

    Filesize

    208KB

  • memory/2168-129-0x0000000004470000-0x0000000004476000-memory.dmp

    Filesize

    24KB

  • memory/2168-128-0x0000000073780000-0x0000000073E6E000-memory.dmp

    Filesize

    6.9MB

  • memory/2168-130-0x0000000007180000-0x0000000007786000-memory.dmp

    Filesize

    6.0MB

  • memory/2168-131-0x0000000007790000-0x000000000789A000-memory.dmp

    Filesize

    1.0MB

  • memory/2168-132-0x0000000006B70000-0x0000000006B80000-memory.dmp

    Filesize

    64KB

  • memory/2168-133-0x0000000006B20000-0x0000000006B32000-memory.dmp

    Filesize

    72KB

  • memory/2168-134-0x00000000078A0000-0x00000000078DE000-memory.dmp

    Filesize

    248KB

  • memory/2168-135-0x0000000007A10000-0x0000000007A5B000-memory.dmp

    Filesize

    300KB

  • memory/2168-136-0x00000000027B0000-0x00000000028B0000-memory.dmp

    Filesize

    1024KB

  • memory/2168-137-0x00000000026D0000-0x000000000270F000-memory.dmp

    Filesize

    252KB

  • memory/2168-138-0x0000000000400000-0x000000000248B000-memory.dmp

    Filesize

    32.5MB

  • memory/2168-139-0x0000000007B50000-0x0000000007BC6000-memory.dmp

    Filesize

    472KB

  • memory/2168-141-0x0000000007BD0000-0x0000000007C62000-memory.dmp

    Filesize

    584KB

  • memory/2168-142-0x0000000007C70000-0x0000000007CD6000-memory.dmp

    Filesize

    408KB

  • memory/2168-143-0x0000000073780000-0x0000000073E6E000-memory.dmp

    Filesize

    6.9MB

  • memory/2168-144-0x00000000084B0000-0x0000000008672000-memory.dmp

    Filesize

    1.8MB

  • memory/2168-145-0x0000000008690000-0x0000000008BBC000-memory.dmp

    Filesize

    5.2MB

  • memory/2168-146-0x0000000008D00000-0x0000000008D50000-memory.dmp

    Filesize

    320KB

  • memory/2168-147-0x0000000006B70000-0x0000000006B80000-memory.dmp

    Filesize

    64KB

  • memory/2168-149-0x0000000000400000-0x000000000248B000-memory.dmp

    Filesize

    32.5MB

  • memory/2168-150-0x0000000073780000-0x0000000073E6E000-memory.dmp

    Filesize

    6.9MB