Analysis

  • max time kernel
    100s
  • max time network
    105s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-08-2023 04:03

General

  • Target

    b3a40e3ebdcf07af5f7fa4e9549ee6ac0303d32723643b57afd3465aed29ec8e.exe

  • Size

    384KB

  • MD5

    deba0ee231fb3d38ba437a3f88810898

  • SHA1

    8f8447693d9d01002a7bf13c7ce7f152db90b24b

  • SHA256

    b3a40e3ebdcf07af5f7fa4e9549ee6ac0303d32723643b57afd3465aed29ec8e

  • SHA512

    fd441f99061caa99e772e5544e199c1bf688677676521fb43d694ca799b5c9f7f5e6bdd2ee022a64677d08378166c1ce6b931a07399fc7faffa26161ff56ae48

  • SSDEEP

    3072:uoND2JdY8WACi9jYCgaFabBiy48rA2SMTrGQe5Z+mxglw2exVopGaJFi1EZ1AI7W:zNYS8Wy9swFabN7GQer+9lw3a0Ax2x8

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.49:6932

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3a40e3ebdcf07af5f7fa4e9549ee6ac0303d32723643b57afd3465aed29ec8e.exe
    "C:\Users\Admin\AppData\Local\Temp\b3a40e3ebdcf07af5f7fa4e9549ee6ac0303d32723643b57afd3465aed29ec8e.exe"
    1⤵
      PID:4436

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4436-123-0x0000000002410000-0x0000000002510000-memory.dmp

      Filesize

      1024KB

    • memory/4436-124-0x0000000002380000-0x00000000023BF000-memory.dmp

      Filesize

      252KB

    • memory/4436-125-0x0000000004280000-0x00000000042B8000-memory.dmp

      Filesize

      224KB

    • memory/4436-126-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/4436-127-0x0000000006A40000-0x0000000006A50000-memory.dmp

      Filesize

      64KB

    • memory/4436-128-0x0000000006A50000-0x0000000006F4E000-memory.dmp

      Filesize

      5.0MB

    • memory/4436-129-0x0000000073AD0000-0x00000000741BE000-memory.dmp

      Filesize

      6.9MB

    • memory/4436-131-0x0000000004300000-0x0000000004334000-memory.dmp

      Filesize

      208KB

    • memory/4436-130-0x0000000006A40000-0x0000000006A50000-memory.dmp

      Filesize

      64KB

    • memory/4436-132-0x0000000006970000-0x0000000006A02000-memory.dmp

      Filesize

      584KB

    • memory/4436-133-0x0000000006A40000-0x0000000006A50000-memory.dmp

      Filesize

      64KB

    • memory/4436-135-0x0000000000400000-0x0000000002307000-memory.dmp

      Filesize

      31.0MB

    • memory/4436-136-0x0000000002380000-0x00000000023BF000-memory.dmp

      Filesize

      252KB

    • memory/4436-137-0x0000000073AD0000-0x00000000741BE000-memory.dmp

      Filesize

      6.9MB