Analysis
- max time kernel
122s - max time network
126s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
15/08/2023, 15:53
General
- Target a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae_JC.exe
- Size 328KB
- Sample230815-tb3srsbf32
- SHA256 a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
51.83.170.21:19447
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae_JC.exe"C:\Users\Admin\AppData\Local\Temp\a3e0afc4f566d77ed6a131c02869aec391da7b01cef8d07e51f729a4a36d77ae_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2916-54-0x0000000000220000-0x0000000000249000-memory.dmp
memory/2916-55-0x00000000002D0000-0x000000000030F000-memory.dmp
memory/2916-56-0x0000000000400000-0x00000000018CF000-memory.dmp
memory/2916-57-0x0000000003530000-0x0000000003568000-memory.dmp
memory/2916-58-0x00000000748C0000-0x0000000074FAE000-memory.dmp
memory/2916-59-0x00000000036A0000-0x00000000036D4000-memory.dmp
memory/2916-60-0x0000000005CB0000-0x0000000005CF0000-memory.dmp
memory/2916-61-0x0000000005CB0000-0x0000000005CF0000-memory.dmp
memory/2916-62-0x0000000003570000-0x0000000003576000-memory.dmp
memory/2916-63-0x0000000000400000-0x00000000018CF000-memory.dmp
memory/2916-64-0x0000000000220000-0x0000000000249000-memory.dmp
memory/2916-65-0x00000000002D0000-0x000000000030F000-memory.dmp
memory/2916-66-0x00000000748C0000-0x0000000074FAE000-memory.dmp
memory/2916-67-0x0000000000400000-0x00000000018CF000-memory.dmp
memory/2916-68-0x00000000748C0000-0x0000000074FAE000-memory.dmp