Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    08-08-2023 23:36

General

  • Target

    f235938a2a7b1712ec278123f70f7529.exe

  • Size

    385KB

  • MD5

    f235938a2a7b1712ec278123f70f7529

  • SHA1

    28760a8523738bcfaf4e95b0de756d324ccc389d

  • SHA256

    e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6

  • SHA512

    c8ccaa244b7bd43fe9cfc68c3af17063d033726bf93a55311084d3ffd263606c2c0737b4e510073a7b4912de329cb51dbc9fe5d88c9238e57f7ec7240576c317

  • SSDEEP

    6144:FnIvVNP8yPuW/UbnW9Pl997LEZKxmEq1Admg5b5FIXc5iDd:Fn8BuW/UTWrQOsoxkJDd

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\f235938a2a7b1712ec278123f70f7529.exe
    "C:\Users\Admin\AppData\Local\Temp\f235938a2a7b1712ec278123f70f7529.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2604-54-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB

  • memory/2604-55-0x0000000004060000-0x0000000004098000-memory.dmp

    Filesize

    224KB

  • memory/2604-56-0x0000000000400000-0x0000000002308000-memory.dmp

    Filesize

    31.0MB

  • memory/2604-57-0x0000000006640000-0x0000000006680000-memory.dmp

    Filesize

    256KB

  • memory/2604-58-0x0000000006640000-0x0000000006680000-memory.dmp

    Filesize

    256KB

  • memory/2604-59-0x0000000003A30000-0x0000000003A6F000-memory.dmp

    Filesize

    252KB

  • memory/2604-61-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2604-60-0x00000000040A0000-0x00000000040D4000-memory.dmp

    Filesize

    208KB

  • memory/2604-62-0x0000000003DF0000-0x0000000003DF6000-memory.dmp

    Filesize

    24KB

  • memory/2604-63-0x0000000006640000-0x0000000006680000-memory.dmp

    Filesize

    256KB

  • memory/2604-65-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB

  • memory/2604-66-0x0000000006640000-0x0000000006680000-memory.dmp

    Filesize

    256KB

  • memory/2604-67-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2604-68-0x0000000000400000-0x0000000002308000-memory.dmp

    Filesize

    31.0MB

  • memory/2604-69-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2604-70-0x0000000000270000-0x0000000000370000-memory.dmp

    Filesize

    1024KB