Analysis

  • max time kernel
    127s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-08-2023 07:22

General

  • Target

    ea79ee028f9137297f4b4f42165658c0c60fd51a54e3df57361079e18cb42e22.exe

  • Size

    338KB

  • MD5

    746ca5e3ab02b0777bdcad33297090f0

  • SHA1

    73a326fcfc65cb4ad7e870c55a75edf9f91e6fef

  • SHA256

    ea79ee028f9137297f4b4f42165658c0c60fd51a54e3df57361079e18cb42e22

  • SHA512

    1c43a659e8acdf044d3f0d12fba194f640306e698e548aae1d0440cb03559aaba3b38a3bc001e2b9b2308bffa3264898924e66e624a9f28baefc5691790dcd38

  • SSDEEP

    6144:OQmnGLItTwgqyd3paDu7pu+I47WeaBZQRmYaIJddg:O/GctT3d3p97pS/eaLADaIJI

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.83.170.21:19447

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea79ee028f9137297f4b4f42165658c0c60fd51a54e3df57361079e18cb42e22.exe
    "C:\Users\Admin\AppData\Local\Temp\ea79ee028f9137297f4b4f42165658c0c60fd51a54e3df57361079e18cb42e22.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/948-121-0x0000000001B40000-0x0000000001B69000-memory.dmp

    Filesize

    164KB

  • memory/948-122-0x0000000001B70000-0x0000000001BAF000-memory.dmp

    Filesize

    252KB

  • memory/948-123-0x00000000039B0000-0x00000000039E8000-memory.dmp

    Filesize

    224KB

  • memory/948-124-0x0000000000400000-0x00000000018D2000-memory.dmp

    Filesize

    20.8MB

  • memory/948-125-0x0000000003A30000-0x0000000003A40000-memory.dmp

    Filesize

    64KB

  • memory/948-126-0x0000000005FC0000-0x00000000064BE000-memory.dmp

    Filesize

    5.0MB

  • memory/948-128-0x0000000003A40000-0x0000000003A74000-memory.dmp

    Filesize

    208KB

  • memory/948-127-0x0000000073D50000-0x000000007443E000-memory.dmp

    Filesize

    6.9MB

  • memory/948-129-0x0000000003890000-0x0000000003896000-memory.dmp

    Filesize

    24KB

  • memory/948-130-0x00000000065C0000-0x0000000006BC6000-memory.dmp

    Filesize

    6.0MB

  • memory/948-131-0x0000000006BD0000-0x0000000006CDA000-memory.dmp

    Filesize

    1.0MB

  • memory/948-133-0x0000000003A30000-0x0000000003A40000-memory.dmp

    Filesize

    64KB

  • memory/948-132-0x0000000006CE0000-0x0000000006CF2000-memory.dmp

    Filesize

    72KB

  • memory/948-134-0x0000000006D00000-0x0000000006D3E000-memory.dmp

    Filesize

    248KB

  • memory/948-135-0x0000000006D90000-0x0000000006DDB000-memory.dmp

    Filesize

    300KB

  • memory/948-136-0x0000000001B40000-0x0000000001B69000-memory.dmp

    Filesize

    164KB

  • memory/948-137-0x0000000000400000-0x00000000018D2000-memory.dmp

    Filesize

    20.8MB

  • memory/948-138-0x0000000001B70000-0x0000000001BAF000-memory.dmp

    Filesize

    252KB

  • memory/948-139-0x0000000073D50000-0x000000007443E000-memory.dmp

    Filesize

    6.9MB

  • memory/948-140-0x0000000006ED0000-0x0000000006F46000-memory.dmp

    Filesize

    472KB

  • memory/948-141-0x0000000006F50000-0x0000000006FE2000-memory.dmp

    Filesize

    584KB

  • memory/948-142-0x00000000070F0000-0x0000000007156000-memory.dmp

    Filesize

    408KB

  • memory/948-143-0x0000000007930000-0x0000000007AF2000-memory.dmp

    Filesize

    1.8MB

  • memory/948-144-0x0000000007B10000-0x000000000803C000-memory.dmp

    Filesize

    5.2MB

  • memory/948-145-0x0000000008550000-0x00000000085A0000-memory.dmp

    Filesize

    320KB

  • memory/948-146-0x0000000003A30000-0x0000000003A40000-memory.dmp

    Filesize

    64KB

  • memory/948-148-0x0000000000400000-0x00000000018D2000-memory.dmp

    Filesize

    20.8MB

  • memory/948-149-0x0000000073D50000-0x000000007443E000-memory.dmp

    Filesize

    6.9MB