Malware Analysis Report

2025-01-18 09:16

Sample ID 230807-amtjpacg23
Target 71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c
SHA256 71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c
Tags
redline logsdiller cloud (tg: @logsdillabot) infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c

Threat Level: Known bad

The file 71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c was found to be: Known bad.

Malicious Activity Summary

redline logsdiller cloud (tg: @logsdillabot) infostealer

RedLine

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-08-07 00:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-07 00:20

Reported

2023-08-07 00:22

Platform

win10-20230703-en

Max time kernel

125s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c.exe"

Signatures

RedLine

infostealer redline

Processes

C:\Users\Admin\AppData\Local\Temp\71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c.exe

"C:\Users\Admin\AppData\Local\Temp\71706e3c46c0217ad5031bce5cb9a9d0fcf4ece0106b1a10a0cb7aa321ccdd2c.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

memory/4532-118-0x00000000025F0000-0x00000000026F0000-memory.dmp

memory/4532-119-0x00000000025A0000-0x00000000025DF000-memory.dmp

memory/4532-120-0x0000000000400000-0x0000000002307000-memory.dmp

memory/4532-121-0x0000000073130000-0x000000007381E000-memory.dmp

memory/4532-122-0x0000000006B80000-0x0000000006B90000-memory.dmp

memory/4532-123-0x00000000043B0000-0x00000000043E8000-memory.dmp

memory/4532-124-0x0000000006B80000-0x0000000006B90000-memory.dmp

memory/4532-125-0x0000000006B80000-0x0000000006B90000-memory.dmp

memory/4532-126-0x0000000006B90000-0x000000000708E000-memory.dmp

memory/4532-127-0x0000000004430000-0x0000000004464000-memory.dmp

memory/4532-128-0x00000000069A0000-0x0000000006A32000-memory.dmp

memory/4532-129-0x00000000025F0000-0x00000000026F0000-memory.dmp

memory/4532-131-0x0000000000400000-0x0000000002307000-memory.dmp

memory/4532-132-0x00000000025A0000-0x00000000025DF000-memory.dmp

memory/4532-133-0x0000000073130000-0x000000007381E000-memory.dmp