Analysis

  • max time kernel
    130s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2024, 03:41

General

  • Target

    ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485.exe

  • Size

    363KB

  • MD5

    c67c38bcfd0fdc9a7a4abf5a5a8789a0

  • SHA1

    e1a5117581270c7dab0e1a70d15fd31c77a2937b

  • SHA256

    ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485

  • SHA512

    a2751280017a5c394b22eb8b6b5dd3f08d0c10be11dcf3e320055be6f049de72f10d499def60c610a19d85b9458c3a9359591bfdef95638417f8b4e21f06f70f

  • SSDEEP

    6144:jA/svhhmEfe4V77FcYEx8u93CXWzlW+G2gdiebORKkS+r8UYNJEe5m621EmUiUkM:0/svhhNfeKEx8ugmz9G2aiebORKkS+hi

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

195.20.16.188:20749

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485.exe
    "C:\Users\Admin\AppData\Local\Temp\ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2056
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:1404
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:1780

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1404-8-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-7-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-5-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-11-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-16-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-14-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-6-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

              • memory/1404-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/3040-17-0x0000000073E50000-0x000000007453E000-memory.dmp

                Filesize

                6.9MB

              • memory/3040-0-0x0000000000F30000-0x0000000000F90000-memory.dmp

                Filesize

                384KB

              • memory/3040-12-0x0000000000340000-0x0000000000341000-memory.dmp

                Filesize

                4KB

              • memory/3040-1-0x0000000073E50000-0x000000007453E000-memory.dmp

                Filesize

                6.9MB

              • memory/3040-4-0x0000000000340000-0x0000000000341000-memory.dmp

                Filesize

                4KB

              • memory/3040-3-0x0000000000C10000-0x0000000000C50000-memory.dmp

                Filesize

                256KB

              • memory/3040-2-0x0000000000340000-0x0000000000341000-memory.dmp

                Filesize

                4KB