Analysis

  • max time kernel
    128s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-08-2023 23:00

General

  • Target

    d3e8352e3ad62782fd6ccde50ed0dabe589d5f5ed4c88c105774b0e8d1b5f8e6.exe

  • Size

    380KB

  • MD5

    ebd91999780c35cf83bc86b899bf8d41

  • SHA1

    4f4c4f9ff54ea06cbe1d0c4ec2a25f9506a419b1

  • SHA256

    d3e8352e3ad62782fd6ccde50ed0dabe589d5f5ed4c88c105774b0e8d1b5f8e6

  • SHA512

    4d86bc5df8d742197166062ab6963b24a3ed41e14d0a50f0d651815386ce0fbcfbe69d5fc7165dc22d581470b9096071f71f7e2db8a399855673b24a86228502

  • SSDEEP

    6144:8Pyp+WPqz5YM8A7vaN5QB3BCmCR+UgT7:8a25YiCuCZRa7

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3e8352e3ad62782fd6ccde50ed0dabe589d5f5ed4c88c105774b0e8d1b5f8e6.exe
    "C:\Users\Admin\AppData\Local\Temp\d3e8352e3ad62782fd6ccde50ed0dabe589d5f5ed4c88c105774b0e8d1b5f8e6.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3996-118-0x0000000002460000-0x0000000002560000-memory.dmp

    Filesize

    1024KB

  • memory/3996-119-0x0000000003E00000-0x0000000003E3F000-memory.dmp

    Filesize

    252KB

  • memory/3996-120-0x0000000004350000-0x0000000004388000-memory.dmp

    Filesize

    224KB

  • memory/3996-121-0x0000000000400000-0x0000000002306000-memory.dmp

    Filesize

    31.0MB

  • memory/3996-123-0x0000000006B20000-0x0000000006B30000-memory.dmp

    Filesize

    64KB

  • memory/3996-122-0x0000000006B20000-0x0000000006B30000-memory.dmp

    Filesize

    64KB

  • memory/3996-124-0x0000000073D00000-0x00000000743EE000-memory.dmp

    Filesize

    6.9MB

  • memory/3996-125-0x0000000006B30000-0x000000000702E000-memory.dmp

    Filesize

    5.0MB

  • memory/3996-126-0x0000000004410000-0x0000000004444000-memory.dmp

    Filesize

    208KB

  • memory/3996-127-0x0000000004490000-0x0000000004496000-memory.dmp

    Filesize

    24KB

  • memory/3996-128-0x0000000007030000-0x0000000007636000-memory.dmp

    Filesize

    6.0MB

  • memory/3996-129-0x0000000007640000-0x000000000774A000-memory.dmp

    Filesize

    1.0MB

  • memory/3996-130-0x0000000004650000-0x0000000004662000-memory.dmp

    Filesize

    72KB

  • memory/3996-131-0x0000000007750000-0x000000000778E000-memory.dmp

    Filesize

    248KB

  • memory/3996-132-0x0000000007890000-0x00000000078DB000-memory.dmp

    Filesize

    300KB

  • memory/3996-133-0x0000000002460000-0x0000000002560000-memory.dmp

    Filesize

    1024KB

  • memory/3996-134-0x0000000003E00000-0x0000000003E3F000-memory.dmp

    Filesize

    252KB

  • memory/3996-135-0x0000000000400000-0x0000000002306000-memory.dmp

    Filesize

    31.0MB

  • memory/3996-136-0x0000000073D00000-0x00000000743EE000-memory.dmp

    Filesize

    6.9MB

  • memory/3996-138-0x00000000079D0000-0x0000000007A46000-memory.dmp

    Filesize

    472KB

  • memory/3996-139-0x0000000007A50000-0x0000000007AE2000-memory.dmp

    Filesize

    584KB

  • memory/3996-140-0x0000000007AF0000-0x0000000007B56000-memory.dmp

    Filesize

    408KB

  • memory/3996-141-0x0000000008360000-0x00000000083B0000-memory.dmp

    Filesize

    320KB

  • memory/3996-142-0x0000000006B20000-0x0000000006B30000-memory.dmp

    Filesize

    64KB

  • memory/3996-143-0x0000000009780000-0x0000000009942000-memory.dmp

    Filesize

    1.8MB

  • memory/3996-144-0x0000000009950000-0x0000000009E7C000-memory.dmp

    Filesize

    5.2MB

  • memory/3996-146-0x0000000000400000-0x0000000002306000-memory.dmp

    Filesize

    31.0MB

  • memory/3996-147-0x0000000073D00000-0x00000000743EE000-memory.dmp

    Filesize

    6.9MB