Analysis
-
max time kernel
127s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
15-08-2023 04:14
Static task
static1
Behavioral task
behavioral1
Sample
dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe
Resource
win10-20230703-en
General
-
Target
dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe
-
Size
341KB
-
MD5
69ebe0e8a9a9b91053e2c0e4d66f0c3d
-
SHA1
f57414de5d88d47281283477cba57d0248b8a96a
-
SHA256
dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94
-
SHA512
5f8d8ca8b54092144490ca053934764becc2a0ffb3ca1e1a944d5d2938a881d07d6ce460c9c201c6543b220c11627d1d38fd4cb725b17799ece9306740ba7786
-
SSDEEP
6144:5cKRlD2MIApfunciGfv6q3JMtNOzAoN7qyelvs09F:5ZPD2MI02GDitGAoNUv
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
51.83.170.21:19447
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 68 dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe 68 dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe 68 dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 68 dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe"C:\Users\Admin\AppData\Local\Temp\dc50ac859d6e0e73cf73569ce0cf00275ec6b47f864a8fd330cce5bd138b2e94.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:68