Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    162s
  • max time network
    162s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13-02-2022 04:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ce2112765fe323f2ca702844a34d11f50818e44cfd91fb5a6bab523ff841fc2.exe

  • Size

    466KB

  • MD5

    678efc7fabdfef639dc1f37b3cc08494

  • SHA1

    1e18c049c3219d46c7ef0e446a72e2fb166a958b

  • SHA256

    8ce2112765fe323f2ca702844a34d11f50818e44cfd91fb5a6bab523ff841fc2

  • SHA512

    dd58826621dcd0e364100c31b098fc00f4481eba635699576ea7b990ec4c7b25ad7d24c14deba784ec89224c2a463a4d6a6f018ef7af1444961d82b05d0aecec

Score
10/10
redlineruzkikakoytoinfostealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes
  • auth_value

    44e87155dd7a4d1957a956ed040ff3fd

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ce2112765fe323f2ca702844a34d11f50818e44cfd91fb5a6bab523ff841fc2.exe
    "C:\Users\Admin\AppData\Local\Temp\8ce2112765fe323f2ca702844a34d11f50818e44cfd91fb5a6bab523ff841fc2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3016-115-0x0000000002DDA000-0x0000000002E06000-memory.dmp
    Filesize

    176KB

    Download
  • memory/3016-116-0x0000000002DDA000-0x0000000002E06000-memory.dmp
    Filesize

    176KB

    Download
  • memory/3016-117-0x0000000002CA0000-0x0000000002CD9000-memory.dmp
    Filesize

    228KB

    Download
  • memory/3016-118-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/3016-119-0x000000007316E000-0x000000007316F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3016-120-0x0000000004A40000-0x0000000004A41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3016-121-0x0000000004A00000-0x0000000004A34000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3016-122-0x0000000004A42000-0x0000000004A43000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3016-123-0x0000000004A43000-0x0000000004A44000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3016-124-0x0000000007250000-0x000000000774E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3016-125-0x0000000007990000-0x00000000079C2000-memory.dmp
    Filesize

    200KB

    Download
  • memory/3016-126-0x00000000079C0000-0x0000000007FC6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3016-127-0x0000000003000000-0x0000000003012000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3016-128-0x0000000007FD0000-0x00000000080DA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3016-129-0x0000000004A44000-0x0000000004A46000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3016-130-0x0000000003070000-0x00000000030AE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3016-131-0x00000000080E0000-0x000000000812B000-memory.dmp
    Filesize

    300KB

    Download