Analysis

  • max time kernel
    125s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-08-2023 21:15

General

  • Target

    cc7bcb15df19d5cb4f94968171c86ae63b46e2ce4a91a95e5f483c84310c9513.exe

  • Size

    372KB

  • MD5

    2640448dc9db67ddafa948aacbd344f1

  • SHA1

    4f394c8da70edc5b7a920dae0fadbba8db8cb339

  • SHA256

    cc7bcb15df19d5cb4f94968171c86ae63b46e2ce4a91a95e5f483c84310c9513

  • SHA512

    77635735c11496b4634836e9b223426bdcb4a906f65d316fb72106c58510a0bfee05286ae1fabd753af049c83f48d1dffdb3aa9b957108418e5e337942bf1242

  • SSDEEP

    6144:LNosZWbR1wQYrrHCQ+FmyxX+7Hc05SbuxpjITj:RoAW11JTsyxXE8USSNIT

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.49:6932

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc7bcb15df19d5cb4f94968171c86ae63b46e2ce4a91a95e5f483c84310c9513.exe
    "C:\Users\Admin\AppData\Local\Temp\cc7bcb15df19d5cb4f94968171c86ae63b46e2ce4a91a95e5f483c84310c9513.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2520-123-0x0000000002540000-0x0000000002640000-memory.dmp

    Filesize

    1024KB

  • memory/2520-124-0x00000000024A0000-0x00000000024DF000-memory.dmp

    Filesize

    252KB

  • memory/2520-125-0x00000000040B0000-0x00000000040E8000-memory.dmp

    Filesize

    224KB

  • memory/2520-126-0x0000000000400000-0x0000000002304000-memory.dmp

    Filesize

    31.0MB

  • memory/2520-127-0x0000000006AD0000-0x0000000006AE0000-memory.dmp

    Filesize

    64KB

  • memory/2520-128-0x0000000006AE0000-0x0000000006FDE000-memory.dmp

    Filesize

    5.0MB

  • memory/2520-129-0x0000000004160000-0x0000000004194000-memory.dmp

    Filesize

    208KB

  • memory/2520-131-0x00000000041B0000-0x00000000041B6000-memory.dmp

    Filesize

    24KB

  • memory/2520-130-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-132-0x0000000006FE0000-0x00000000075E6000-memory.dmp

    Filesize

    6.0MB

  • memory/2520-133-0x00000000075F0000-0x00000000076FA000-memory.dmp

    Filesize

    1.0MB

  • memory/2520-134-0x0000000006AB0000-0x0000000006AC2000-memory.dmp

    Filesize

    72KB

  • memory/2520-135-0x0000000006AD0000-0x0000000006AE0000-memory.dmp

    Filesize

    64KB

  • memory/2520-136-0x0000000007700000-0x000000000773E000-memory.dmp

    Filesize

    248KB

  • memory/2520-137-0x0000000007790000-0x00000000077DB000-memory.dmp

    Filesize

    300KB

  • memory/2520-138-0x0000000002540000-0x0000000002640000-memory.dmp

    Filesize

    1024KB

  • memory/2520-139-0x0000000000400000-0x0000000002304000-memory.dmp

    Filesize

    31.0MB

  • memory/2520-141-0x00000000024A0000-0x00000000024DF000-memory.dmp

    Filesize

    252KB

  • memory/2520-142-0x0000000006AD0000-0x0000000006AE0000-memory.dmp

    Filesize

    64KB

  • memory/2520-143-0x00000000079D0000-0x0000000007A46000-memory.dmp

    Filesize

    472KB

  • memory/2520-144-0x0000000007A50000-0x0000000007AE2000-memory.dmp

    Filesize

    584KB

  • memory/2520-145-0x0000000007AF0000-0x0000000007B56000-memory.dmp

    Filesize

    408KB

  • memory/2520-146-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-147-0x000000000A360000-0x000000000A522000-memory.dmp

    Filesize

    1.8MB

  • memory/2520-148-0x000000000A530000-0x000000000AA5C000-memory.dmp

    Filesize

    5.2MB

  • memory/2520-149-0x0000000008620000-0x0000000008670000-memory.dmp

    Filesize

    320KB

  • memory/2520-150-0x0000000006AD0000-0x0000000006AE0000-memory.dmp

    Filesize

    64KB

  • memory/2520-152-0x0000000000400000-0x0000000002304000-memory.dmp

    Filesize

    31.0MB

  • memory/2520-153-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB