Analysis

  • max time kernel
    127s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2023 10:18

General

  • Target

    3752-126-0x00000000044A0000-0x00000000044D4000-memory.exe

  • Size

    208KB

  • MD5

    1f90044095036f77dc1edee283b7ab03

  • SHA1

    2265afa4259496c5b45b8e61c97c98244b3de86d

  • SHA256

    c4efb8d7a199d7b85411e8a109e3d13982a1190be2d6237431379d5228552eba

  • SHA512

    16917231e2435abf74932c77e6935c25e9d26daca6798698e0417addc8953f8f6e5501c5d2fa17f43a6c10e0839be65ee420a17b09ce583401386aa2f03b7885

  • SSDEEP

    3072:4eG4mt57f3YInEGK2U/YetUBaVa0b6AyM9w+Zxwak8e8hV:S4mt57gInEG3YetMb6

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

209.250.248.11:33522

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3752-126-0x00000000044A0000-0x00000000044D4000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\3752-126-0x00000000044A0000-0x00000000044D4000-memory.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1128-133-0x0000000000BE0000-0x0000000000C14000-memory.dmp

    Filesize

    208KB

  • memory/1128-134-0x0000000075350000-0x0000000075B00000-memory.dmp

    Filesize

    7.7MB

  • memory/1128-135-0x0000000005D90000-0x00000000063A8000-memory.dmp

    Filesize

    6.1MB

  • memory/1128-136-0x0000000005880000-0x000000000598A000-memory.dmp

    Filesize

    1.0MB

  • memory/1128-137-0x0000000005760000-0x0000000005770000-memory.dmp

    Filesize

    64KB

  • memory/1128-138-0x00000000056B0000-0x00000000056C2000-memory.dmp

    Filesize

    72KB

  • memory/1128-139-0x0000000005710000-0x000000000574C000-memory.dmp

    Filesize

    240KB

  • memory/1128-140-0x0000000005A20000-0x0000000005A96000-memory.dmp

    Filesize

    472KB

  • memory/1128-141-0x0000000005B40000-0x0000000005BD2000-memory.dmp

    Filesize

    584KB

  • memory/1128-142-0x0000000006E50000-0x00000000073F4000-memory.dmp

    Filesize

    5.6MB

  • memory/1128-143-0x0000000005CE0000-0x0000000005D46000-memory.dmp

    Filesize

    408KB

  • memory/1128-144-0x0000000075350000-0x0000000075B00000-memory.dmp

    Filesize

    7.7MB

  • memory/1128-145-0x0000000005760000-0x0000000005770000-memory.dmp

    Filesize

    64KB

  • memory/1128-146-0x0000000006B70000-0x0000000006D32000-memory.dmp

    Filesize

    1.8MB

  • memory/1128-147-0x0000000009020000-0x000000000954C000-memory.dmp

    Filesize

    5.2MB

  • memory/1128-148-0x0000000007590000-0x00000000075E0000-memory.dmp

    Filesize

    320KB

  • memory/1128-150-0x0000000075350000-0x0000000075B00000-memory.dmp

    Filesize

    7.7MB