Analysis

  • max time kernel
    127s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-08-2023 17:43

General

  • Target

    b627149008d1c56175402960e3b2a8513ad4021cbe93cd64c8d6a93331d911b5.exe

  • Size

    313KB

  • MD5

    756b2a3d105ca11bccb51818718fbd31

  • SHA1

    65cda28e1b9e4584f1a328a6d846a114d42d8450

  • SHA256

    b627149008d1c56175402960e3b2a8513ad4021cbe93cd64c8d6a93331d911b5

  • SHA512

    35742a1e602141f8653f95a496cbeccb467053123832bc02776ec90ba0ea6635933c3ff66ca8308ec6c496f42ca2f8a68e86f9a6943f6b445a96b2c147a15a8e

  • SSDEEP

    6144:p7YLSnYReaimzhimI37ej3pV374sMq9sTOCcMx:yeYRjimFirsosMq98O9

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b627149008d1c56175402960e3b2a8513ad4021cbe93cd64c8d6a93331d911b5.exe
    "C:\Users\Admin\AppData\Local\Temp\b627149008d1c56175402960e3b2a8513ad4021cbe93cd64c8d6a93331d911b5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4900-118-0x00000000034D0000-0x00000000034F9000-memory.dmp

    Filesize

    164KB

  • memory/4900-119-0x0000000003510000-0x000000000354F000-memory.dmp

    Filesize

    252KB

  • memory/4900-120-0x0000000003A90000-0x0000000003AC8000-memory.dmp

    Filesize

    224KB

  • memory/4900-121-0x0000000000400000-0x00000000018CC000-memory.dmp

    Filesize

    20.8MB

  • memory/4900-122-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

    Filesize

    64KB

  • memory/4900-123-0x0000000005FC0000-0x00000000064BE000-memory.dmp

    Filesize

    5.0MB

  • memory/4900-124-0x0000000003B10000-0x0000000003B44000-memory.dmp

    Filesize

    208KB

  • memory/4900-125-0x0000000073570000-0x0000000073C5E000-memory.dmp

    Filesize

    6.9MB

  • memory/4900-126-0x0000000005F50000-0x0000000005F56000-memory.dmp

    Filesize

    24KB

  • memory/4900-127-0x00000000065C0000-0x0000000006BC6000-memory.dmp

    Filesize

    6.0MB

  • memory/4900-128-0x0000000006BD0000-0x0000000006CDA000-memory.dmp

    Filesize

    1.0MB

  • memory/4900-129-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

    Filesize

    64KB

  • memory/4900-130-0x0000000005F90000-0x0000000005FA2000-memory.dmp

    Filesize

    72KB

  • memory/4900-131-0x0000000006CE0000-0x0000000006D1E000-memory.dmp

    Filesize

    248KB

  • memory/4900-132-0x0000000006D80000-0x0000000006DCB000-memory.dmp

    Filesize

    300KB

  • memory/4900-133-0x0000000000400000-0x00000000018CC000-memory.dmp

    Filesize

    20.8MB

  • memory/4900-134-0x00000000034D0000-0x00000000034F9000-memory.dmp

    Filesize

    164KB

  • memory/4900-135-0x0000000006EC0000-0x0000000006F36000-memory.dmp

    Filesize

    472KB

  • memory/4900-136-0x0000000006F40000-0x0000000006FD2000-memory.dmp

    Filesize

    584KB

  • memory/4900-137-0x0000000003510000-0x000000000354F000-memory.dmp

    Filesize

    252KB

  • memory/4900-138-0x0000000006FE0000-0x0000000007046000-memory.dmp

    Filesize

    408KB

  • memory/4900-139-0x0000000073570000-0x0000000073C5E000-memory.dmp

    Filesize

    6.9MB

  • memory/4900-140-0x0000000007A30000-0x0000000007BF2000-memory.dmp

    Filesize

    1.8MB

  • memory/4900-141-0x0000000007C10000-0x000000000813C000-memory.dmp

    Filesize

    5.2MB

  • memory/4900-142-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

    Filesize

    64KB

  • memory/4900-143-0x0000000008320000-0x0000000008370000-memory.dmp

    Filesize

    320KB

  • memory/4900-145-0x0000000000400000-0x00000000018CC000-memory.dmp

    Filesize

    20.8MB

  • memory/4900-146-0x0000000073570000-0x0000000073C5E000-memory.dmp

    Filesize

    6.9MB