Analysis Overview
SHA256
3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff
Threat Level: Known bad
The file 3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine payload
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-12-11 04:51
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-11 04:51
Reported
2023-12-11 04:56
Platform
win7-20231201-en
Max time kernel
118s
Max time network
122s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff.exe
"C:\Users\Admin\AppData\Local\Temp\3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 77.105.132.87:6731 | tcp |
Files
memory/1772-0-0x00000000002E0000-0x000000000031C000-memory.dmp
memory/1772-5-0x0000000074C40000-0x000000007532E000-memory.dmp
memory/1772-6-0x0000000002770000-0x00000000027B0000-memory.dmp
memory/1772-7-0x0000000074C40000-0x000000007532E000-memory.dmp
memory/1772-8-0x0000000002770000-0x00000000027B0000-memory.dmp
memory/1772-10-0x0000000074C40000-0x000000007532E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-11 04:51
Reported
2023-12-11 04:56
Platform
win10-20231020-en
Max time kernel
64s
Max time network
177s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff.exe
"C:\Users\Admin\AppData\Local\Temp\3b366cac4e2f2836e46b90e357f3e3d1b60e82e1a45c33f0cbaaf009b40bdfff.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 77.105.132.87:6731 | tcp | |
| US | 8.8.8.8:53 | 87.132.105.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.0.a.d.3.0.d.6.9.9.7.c.2.6.3.7.1.0.a.d.3.0.3.7.8.0.8.0.8.0.8.0.ip6.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
memory/1300-0-0x0000000002480000-0x00000000024BC000-memory.dmp
memory/1300-5-0x0000000073340000-0x0000000073A2E000-memory.dmp
memory/1300-6-0x00000000077F0000-0x0000000007CEE000-memory.dmp
memory/1300-7-0x00000000072F0000-0x0000000007382000-memory.dmp
memory/1300-8-0x00000000074B0000-0x00000000074C0000-memory.dmp
memory/1300-9-0x0000000007470000-0x000000000747A000-memory.dmp
memory/1300-10-0x0000000008700000-0x0000000008D06000-memory.dmp
memory/1300-12-0x0000000009E70000-0x0000000009E82000-memory.dmp
memory/1300-13-0x0000000009ED0000-0x0000000009F0E000-memory.dmp
memory/1300-11-0x0000000009F60000-0x000000000A06A000-memory.dmp
memory/1300-14-0x0000000009F10000-0x0000000009F5B000-memory.dmp
memory/1300-15-0x000000000AAA0000-0x000000000AB06000-memory.dmp
memory/1300-16-0x00000000074B0000-0x00000000074C0000-memory.dmp
memory/1300-17-0x0000000073340000-0x0000000073A2E000-memory.dmp
memory/1300-18-0x000000000B020000-0x000000000B1E2000-memory.dmp
memory/1300-19-0x000000000BBA0000-0x000000000C0CC000-memory.dmp
memory/1300-20-0x000000000AFA0000-0x000000000AFF0000-memory.dmp
memory/1300-23-0x0000000073340000-0x0000000073A2E000-memory.dmp