Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 13:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46b5f74c3abaca648ca759316655537338ea2437e3086194584178ff1acc4ff3.exe

  • Size

    402KB

  • MD5

    9d121b67b846bd6ac224ca903570c7f8

  • SHA1

    d79d1aba92ec816fcaced3873a4eb5adbb842e2c

  • SHA256

    46b5f74c3abaca648ca759316655537338ea2437e3086194584178ff1acc4ff3

  • SHA512

    ef52e868ff758476ceee84b5dd73bd3fdbb14edea486edaed3965655b2d2c6a7c6a75eb9593b213d9b1b94305c8c695a49fdd22ee6be9354dc970ba2b844b073

Score
10/10
redlinenonameinfostealer

Malware Config

Extracted

Family

redline

Botnet

NONAME

C2

45.9.20.111:1355

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46b5f74c3abaca648ca759316655537338ea2437e3086194584178ff1acc4ff3.exe
    "C:\Users\Admin\AppData\Local\Temp\46b5f74c3abaca648ca759316655537338ea2437e3086194584178ff1acc4ff3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3068-115-0x0000000000470000-0x00000000005BA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3068-116-0x00000000008C0000-0x00000000008F9000-memory.dmp
    Filesize

    228KB

    Download
  • memory/3068-117-0x0000000002550000-0x0000000002584000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3068-118-0x0000000004C80000-0x000000000517E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3068-119-0x0000000004B20000-0x0000000004B52000-memory.dmp
    Filesize

    200KB

    Download
  • memory/3068-120-0x0000000000400000-0x000000000046C000-memory.dmp
    Filesize

    432KB

    Download
  • memory/3068-121-0x0000000004C70000-0x0000000004C71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3068-122-0x0000000004C72000-0x0000000004C73000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3068-123-0x0000000004C73000-0x0000000004C74000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3068-124-0x0000000005180000-0x0000000005786000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3068-125-0x0000000004C10000-0x0000000004C22000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3068-126-0x0000000005790000-0x000000000589A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3068-127-0x00000000058F0000-0x000000000592E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3068-128-0x0000000004C74000-0x0000000004C76000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3068-129-0x0000000005930000-0x000000000597B000-memory.dmp
    Filesize

    300KB

    Download