Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-08-2023 15:57

General

  • Target

    793c5832f007199c128dcb5a56bdb600d9edb69731fcf4769b102dcf4b434c13.exe

  • Size

    312KB

  • MD5

    d7f301c6cba9d944f7cd046297ecda42

  • SHA1

    db6332ca315dd948f432cda88d5bc023706ba1af

  • SHA256

    793c5832f007199c128dcb5a56bdb600d9edb69731fcf4769b102dcf4b434c13

  • SHA512

    fd4b6758f19da28ebc4ebba9d8167decd3bacdeea73687ed2a7a0038fd52cfe43621a592959fef4907f60918cfb53f65ead357b3b13102cdfd82b5eab197923c

  • SSDEEP

    6144:IziLa4MxNEC/Xi8+1Jxua5ZDCtZd6JfWZRb:19MxOSc13PDQHp

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.49:6932

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\793c5832f007199c128dcb5a56bdb600d9edb69731fcf4769b102dcf4b434c13.exe
    "C:\Users\Admin\AppData\Local\Temp\793c5832f007199c128dcb5a56bdb600d9edb69731fcf4769b102dcf4b434c13.exe"
    1⤵
      PID:832

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/832-120-0x0000000001930000-0x0000000001959000-memory.dmp

      Filesize

      164KB

    • memory/832-121-0x0000000001A50000-0x0000000001A8F000-memory.dmp

      Filesize

      252KB

    • memory/832-122-0x0000000000400000-0x00000000018CB000-memory.dmp

      Filesize

      20.8MB

    • memory/832-123-0x00000000734A0000-0x0000000073B8E000-memory.dmp

      Filesize

      6.9MB

    • memory/832-124-0x0000000003D50000-0x0000000003D60000-memory.dmp

      Filesize

      64KB

    • memory/832-125-0x00000000038B0000-0x00000000038E8000-memory.dmp

      Filesize

      224KB

    • memory/832-126-0x0000000003D50000-0x0000000003D60000-memory.dmp

      Filesize

      64KB

    • memory/832-127-0x0000000003D50000-0x0000000003D60000-memory.dmp

      Filesize

      64KB

    • memory/832-128-0x00000000060B0000-0x00000000065AE000-memory.dmp

      Filesize

      5.0MB

    • memory/832-129-0x0000000003910000-0x0000000003944000-memory.dmp

      Filesize

      208KB

    • memory/832-130-0x0000000003BE0000-0x0000000003C72000-memory.dmp

      Filesize

      584KB

    • memory/832-132-0x0000000000400000-0x00000000018CB000-memory.dmp

      Filesize

      20.8MB

    • memory/832-133-0x0000000001A50000-0x0000000001A8F000-memory.dmp

      Filesize

      252KB

    • memory/832-134-0x0000000001930000-0x0000000001959000-memory.dmp

      Filesize

      164KB

    • memory/832-135-0x00000000734A0000-0x0000000073B8E000-memory.dmp

      Filesize

      6.9MB