Analysis

  • max time kernel
    125s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-08-2023 00:20

General

  • Target

    71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c.exe

  • Size

    384KB

  • MD5

    67b4f70e66276e85f7a7f7541463e41c

  • SHA1

    94dd6b2e55139123b245be2e4cc3b1857abf7270

  • SHA256

    71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c

  • SHA512

    599467a5664c15836ec92eb97b0c67b99752fe22915b88d1d2d4d193900c41ff42c9900e411367b57747a5e2f39c1e6bbbe6c015c23757ac2dbd971fb8b22ec8

  • SSDEEP

    6144:ENXyTWh9LgFSTO3Kj4jj45DKZtFi6HYBJl:OiTS9LaS4jb/Fi6Hml

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.49:6932

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c.exe
    "C:\Users\Admin\AppData\Local\Temp\71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c.exe"
    1⤵
      PID:4532

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4532-118-0x00000000025F0000-0x00000000026F0000-memory.dmp

      Filesize

      1024KB

    • memory/4532-119-0x00000000025A0000-0x00000000025DF000-memory.dmp

      Filesize

      252KB

    • memory/4532-120-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/4532-121-0x0000000073130000-0x000000007381E000-memory.dmp

      Filesize

      6.9MB

    • memory/4532-122-0x0000000006B80000-0x0000000006B90000-memory.dmp

      Filesize

      64KB

    • memory/4532-123-0x00000000043B0000-0x00000000043E8000-memory.dmp

      Filesize

      224KB

    • memory/4532-124-0x0000000006B80000-0x0000000006B90000-memory.dmp

      Filesize

      64KB

    • memory/4532-125-0x0000000006B80000-0x0000000006B90000-memory.dmp

      Filesize

      64KB

    • memory/4532-126-0x0000000006B90000-0x000000000708E000-memory.dmp

      Filesize

      5.0MB

    • memory/4532-127-0x0000000004430000-0x0000000004464000-memory.dmp

      Filesize

      208KB

    • memory/4532-128-0x00000000069A0000-0x0000000006A32000-memory.dmp

      Filesize

      584KB

    • memory/4532-129-0x00000000025F0000-0x00000000026F0000-memory.dmp

      Filesize

      1024KB

    • memory/4532-131-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/4532-132-0x00000000025A0000-0x00000000025DF000-memory.dmp

      Filesize

      252KB

    • memory/4532-133-0x0000000073130000-0x000000007381E000-memory.dmp

      Filesize

      6.9MB