Analysis

  • max time kernel
    290s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/06/2024, 23:31

General

  • Target

    f1b8332cb1131e1e6d8bb133579c2474d7f3ff73e520b31a0bc71f67241a4013.exe

  • Size

    3.7MB

  • MD5

    851540a8a61d4606a6e7df206c7211e6

  • SHA1

    1694c00781c85ee4aff42dcf67ad3752daa80c35

  • SHA256

    f1b8332cb1131e1e6d8bb133579c2474d7f3ff73e520b31a0bc71f67241a4013

  • SHA512

    03bfcf302bda2a73bf19baf45d6e6d726fc78b87b1b3eb37f9d5f2d28b3b039ee1f5e0d75bdd6d80f8b3e549125314ee4fe896671f667e52aab638aa2338d609

  • SSDEEP

    49152:W8rXn233KExXMbs5rseJy58Y8bWftef4R0Upyw+dr9TbaM9a6NLVxx6v57H2H8Ux:Wt3Ke/5Ieri/R3MTbaM9VNx6h7W1A

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.92:27953

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1b8332cb1131e1e6d8bb133579c2474d7f3ff73e520b31a0bc71f67241a4013.exe
    "C:\Users\Admin\AppData\Local\Temp\f1b8332cb1131e1e6d8bb133579c2474d7f3ff73e520b31a0bc71f67241a4013.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:424
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:1408

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/796-42-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-19-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-2-0x0000000005060000-0x00000000050FC000-memory.dmp

              Filesize

              624KB

            • memory/796-3-0x0000000073990000-0x000000007407E000-memory.dmp

              Filesize

              6.9MB

            • memory/796-4-0x0000000005200000-0x000000000534C000-memory.dmp

              Filesize

              1.3MB

            • memory/796-5-0x0000000004EF0000-0x0000000004F0C000-memory.dmp

              Filesize

              112KB

            • memory/796-6-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-13-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-63-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-39-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-71-0x0000000073990000-0x000000007407E000-memory.dmp

              Filesize

              6.9MB

            • memory/796-7-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-66-0x0000000073990000-0x000000007407E000-memory.dmp

              Filesize

              6.9MB

            • memory/796-65-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-61-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-59-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-57-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-55-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-53-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-52-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-49-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-47-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-45-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-43-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-1-0x0000000000270000-0x0000000000630000-memory.dmp

              Filesize

              3.8MB

            • memory/796-9-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-0-0x000000007399E000-0x000000007399F000-memory.dmp

              Filesize

              4KB

            • memory/796-35-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-33-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-32-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-29-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-27-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-25-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-23-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-21-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-37-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-18-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-15-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/796-11-0x0000000004EF0000-0x0000000004F05000-memory.dmp

              Filesize

              84KB

            • memory/1408-74-0x0000000003000000-0x000000000300A000-memory.dmp

              Filesize

              40KB

            • memory/1408-70-0x0000000073990000-0x000000007407E000-memory.dmp

              Filesize

              6.9MB

            • memory/1408-69-0x0000000005BE0000-0x00000000060DE000-memory.dmp

              Filesize

              5.0MB

            • memory/1408-72-0x00000000056E0000-0x0000000005772000-memory.dmp

              Filesize

              584KB

            • memory/1408-73-0x0000000073990000-0x000000007407E000-memory.dmp

              Filesize

              6.9MB

            • memory/1408-67-0x0000000000400000-0x0000000000450000-memory.dmp

              Filesize

              320KB

            • memory/1408-75-0x00000000066F0000-0x0000000006CF6000-memory.dmp

              Filesize

              6.0MB

            • memory/1408-76-0x0000000005A70000-0x0000000005B7A000-memory.dmp

              Filesize

              1.0MB

            • memory/1408-77-0x00000000058B0000-0x00000000058C2000-memory.dmp

              Filesize

              72KB

            • memory/1408-78-0x0000000005910000-0x000000000594E000-memory.dmp

              Filesize

              248KB

            • memory/1408-79-0x0000000005960000-0x00000000059AB000-memory.dmp

              Filesize

              300KB

            • memory/1408-80-0x0000000073990000-0x000000007407E000-memory.dmp

              Filesize

              6.9MB