Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
11/08/2023, 07:48
General
- Target 0c8972daf5bfd9c451bb35a829a0a76a.exe
- Size 327KB
- Sample230811-jncf8sbf63
- SHA256 e70a0a203a7ad5a9b8526cc0615b51bbe5358418e277014847db9b4df774c271
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
136.244.98.226:33587
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c8972daf5bfd9c451bb35a829a0a76a.exe"C:\Users\Admin\AppData\Local\Temp\0c8972daf5bfd9c451bb35a829a0a76a.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 10882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4596 -ip 45961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4596-0-0x00000000034D0000-0x00000000034F9000-memory.dmp
memory/4596-1-0x0000000003500000-0x000000000353F000-memory.dmp
memory/4596-2-0x0000000000400000-0x00000000018CF000-memory.dmp
memory/4596-3-0x0000000005F90000-0x0000000005FC8000-memory.dmp
memory/4596-4-0x0000000074960000-0x0000000075110000-memory.dmp
memory/4596-6-0x0000000006050000-0x00000000065F4000-memory.dmp
memory/4596-5-0x0000000006040000-0x0000000006050000-memory.dmp
memory/4596-8-0x0000000006010000-0x0000000006044000-memory.dmp
memory/4596-9-0x0000000006040000-0x0000000006050000-memory.dmp
memory/4596-7-0x0000000006040000-0x0000000006050000-memory.dmp
memory/4596-10-0x0000000006670000-0x0000000006702000-memory.dmp
memory/4596-12-0x0000000000400000-0x00000000018CF000-memory.dmp
memory/4596-13-0x0000000003500000-0x000000000353F000-memory.dmp
memory/4596-14-0x0000000074960000-0x0000000075110000-memory.dmp