Analysis

  • max time kernel
    125s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-08-2023 17:53

General

  • Target

    e4f9c655581551a9238d6eba448ac9b6e36516a4a9ef449e6e7cb21b52c28f55.exe

  • Size

    319KB

  • MD5

    2be9bcc8cbd73b5baee5594355a7870d

  • SHA1

    02153a313daaefebd9577d067cd0bd98400bd4fd

  • SHA256

    e4f9c655581551a9238d6eba448ac9b6e36516a4a9ef449e6e7cb21b52c28f55

  • SHA512

    0ea5e70c82c92af983779e2311aa1791b56d76f20d4df72dc966039e4368c54e9668d775ab73b55fb19545bdc37a0b7b640a30e5ffac1768f81247e2b136f023

  • SSDEEP

    6144:iXKLL2S+/qG+pXTJJxTqYQd2ymTPmLii4ed2CO:iXKLqSZG+1TRmYQd2BwZ8

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.83.170.21:19447

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4f9c655581551a9238d6eba448ac9b6e36516a4a9ef449e6e7cb21b52c28f55.exe
    "C:\Users\Admin\AppData\Local\Temp\e4f9c655581551a9238d6eba448ac9b6e36516a4a9ef449e6e7cb21b52c28f55.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2460-122-0x00000000019F0000-0x0000000001A19000-memory.dmp

    Filesize

    164KB

  • memory/2460-123-0x0000000003530000-0x000000000356F000-memory.dmp

    Filesize

    252KB

  • memory/2460-124-0x0000000000400000-0x00000000018CD000-memory.dmp

    Filesize

    20.8MB

  • memory/2460-125-0x0000000003930000-0x0000000003940000-memory.dmp

    Filesize

    64KB

  • memory/2460-126-0x0000000003830000-0x0000000003868000-memory.dmp

    Filesize

    224KB

  • memory/2460-127-0x0000000073A40000-0x000000007412E000-memory.dmp

    Filesize

    6.9MB

  • memory/2460-128-0x0000000003930000-0x0000000003940000-memory.dmp

    Filesize

    64KB

  • memory/2460-129-0x0000000005FD0000-0x00000000064CE000-memory.dmp

    Filesize

    5.0MB

  • memory/2460-130-0x00000000038F0000-0x0000000003924000-memory.dmp

    Filesize

    208KB

  • memory/2460-131-0x0000000003940000-0x0000000003946000-memory.dmp

    Filesize

    24KB

  • memory/2460-132-0x000000000B950000-0x000000000BF56000-memory.dmp

    Filesize

    6.0MB

  • memory/2460-133-0x000000000BFA0000-0x000000000C0AA000-memory.dmp

    Filesize

    1.0MB

  • memory/2460-135-0x0000000003930000-0x0000000003940000-memory.dmp

    Filesize

    64KB

  • memory/2460-134-0x000000000C0E0000-0x000000000C0F2000-memory.dmp

    Filesize

    72KB

  • memory/2460-136-0x000000000C100000-0x000000000C13E000-memory.dmp

    Filesize

    248KB

  • memory/2460-137-0x000000000C1A0000-0x000000000C1EB000-memory.dmp

    Filesize

    300KB

  • memory/2460-138-0x0000000000400000-0x00000000018CD000-memory.dmp

    Filesize

    20.8MB

  • memory/2460-139-0x00000000019F0000-0x0000000001A19000-memory.dmp

    Filesize

    164KB

  • memory/2460-140-0x0000000003530000-0x000000000356F000-memory.dmp

    Filesize

    252KB

  • memory/2460-141-0x0000000073A40000-0x000000007412E000-memory.dmp

    Filesize

    6.9MB

  • memory/2460-142-0x000000000C2E0000-0x000000000C356000-memory.dmp

    Filesize

    472KB

  • memory/2460-143-0x000000000C360000-0x000000000C3F2000-memory.dmp

    Filesize

    584KB

  • memory/2460-144-0x000000000C500000-0x000000000C566000-memory.dmp

    Filesize

    408KB

  • memory/2460-145-0x000000000CC30000-0x000000000CDF2000-memory.dmp

    Filesize

    1.8MB

  • memory/2460-146-0x000000000CE00000-0x000000000D32C000-memory.dmp

    Filesize

    5.2MB

  • memory/2460-147-0x000000000D540000-0x000000000D590000-memory.dmp

    Filesize

    320KB

  • memory/2460-148-0x0000000003930000-0x0000000003940000-memory.dmp

    Filesize

    64KB

  • memory/2460-150-0x0000000000400000-0x00000000018CD000-memory.dmp

    Filesize

    20.8MB

  • memory/2460-152-0x0000000073A40000-0x000000007412E000-memory.dmp

    Filesize

    6.9MB