Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 03:41

General

  • Target

    ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485.exe

  • Size

    363KB

  • MD5

    c67c38bcfd0fdc9a7a4abf5a5a8789a0

  • SHA1

    e1a5117581270c7dab0e1a70d15fd31c77a2937b

  • SHA256

    ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485

  • SHA512

    a2751280017a5c394b22eb8b6b5dd3f08d0c10be11dcf3e320055be6f049de72f10d499def60c610a19d85b9458c3a9359591bfdef95638417f8b4e21f06f70f

  • SSDEEP

    6144:jA/svhhmEfe4V77FcYEx8u93CXWzlW+G2gdiebORKkS+r8UYNJEe5m621EmUiUkM:0/svhhNfeKEx8ugmz9G2aiebORKkS+hi

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

195.20.16.188:20749

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485.exe
    "C:\Users\Admin\AppData\Local\Temp\ee7f176672fb6774c261d8eb419db32d66dcd350aebc465e34860d80eb573485.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:4780

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/548-4-0x0000000002730000-0x0000000002731000-memory.dmp

            Filesize

            4KB

          • memory/548-0-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/548-6-0x0000000002730000-0x0000000002731000-memory.dmp

            Filesize

            4KB

          • memory/548-2-0x0000000002740000-0x0000000002750000-memory.dmp

            Filesize

            64KB

          • memory/548-1-0x0000000000370000-0x00000000003D0000-memory.dmp

            Filesize

            384KB

          • memory/548-3-0x0000000002730000-0x0000000002731000-memory.dmp

            Filesize

            4KB

          • memory/548-8-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4780-12-0x00000000055F0000-0x0000000005600000-memory.dmp

            Filesize

            64KB

          • memory/4780-11-0x00000000053D0000-0x0000000005462000-memory.dmp

            Filesize

            584KB

          • memory/4780-10-0x00000000058A0000-0x0000000005E44000-memory.dmp

            Filesize

            5.6MB

          • memory/4780-9-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4780-5-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

          • memory/4780-13-0x0000000005570000-0x000000000557A000-memory.dmp

            Filesize

            40KB

          • memory/4780-14-0x0000000006470000-0x0000000006A88000-memory.dmp

            Filesize

            6.1MB

          • memory/4780-15-0x0000000005E50000-0x0000000005F5A000-memory.dmp

            Filesize

            1.0MB

          • memory/4780-16-0x00000000057B0000-0x00000000057C2000-memory.dmp

            Filesize

            72KB

          • memory/4780-17-0x0000000005810000-0x000000000584C000-memory.dmp

            Filesize

            240KB

          • memory/4780-18-0x0000000005850000-0x000000000589C000-memory.dmp

            Filesize

            304KB

          • memory/4780-19-0x00000000746F0000-0x0000000074EA0000-memory.dmp

            Filesize

            7.7MB

          • memory/4780-20-0x00000000055F0000-0x0000000005600000-memory.dmp

            Filesize

            64KB