Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    170s
  • max time network
    169s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13-02-2022 08:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a78131af458274c3ea4932ce84ebd22de1d3965b7d7ce6b011c0ba7efcb6a0fa.exe

  • Size

    470KB

  • MD5

    7bae38a784bd23a220f972285d052c3b

  • SHA1

    40301377e05a681caac42cabc9ae668d512d2514

  • SHA256

    a78131af458274c3ea4932ce84ebd22de1d3965b7d7ce6b011c0ba7efcb6a0fa

  • SHA512

    2e0b63018bf171225b44732a24030214bb4ebd30c10c84e2a100ff721a002cf09a310f994d509c541df7441107dbd30cfcf8714c022a7391f4c55835ae422ab7

Score
10/10
redlineruzkikakoytoinfostealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes
  • auth_value

    44e87155dd7a4d1957a956ed040ff3fd

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a78131af458274c3ea4932ce84ebd22de1d3965b7d7ce6b011c0ba7efcb6a0fa.exe
    "C:\Users\Admin\AppData\Local\Temp\a78131af458274c3ea4932ce84ebd22de1d3965b7d7ce6b011c0ba7efcb6a0fa.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1772-115-0x0000000002DEA000-0x0000000002E16000-memory.dmp
    Filesize

    176KB

    Download
  • memory/1772-116-0x0000000002DEA000-0x0000000002E16000-memory.dmp
    Filesize

    176KB

    Download
  • memory/1772-117-0x0000000004870000-0x00000000048A9000-memory.dmp
    Filesize

    228KB

    Download
  • memory/1772-118-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/1772-119-0x000000007307E000-0x000000007307F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1772-120-0x00000000049E0000-0x00000000049E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1772-121-0x0000000004A10000-0x0000000004A44000-memory.dmp
    Filesize

    208KB

    Download
  • memory/1772-122-0x00000000049E2000-0x00000000049E3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1772-123-0x00000000049E3000-0x00000000049E4000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1772-124-0x0000000007380000-0x000000000787E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1772-125-0x0000000004CF0000-0x0000000004D22000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1772-126-0x0000000008090000-0x0000000008696000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/1772-127-0x0000000002D30000-0x0000000002D42000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1772-128-0x0000000007A80000-0x0000000007B8A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1772-129-0x00000000049E4000-0x00000000049E6000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1772-130-0x0000000004E50000-0x0000000004E8E000-memory.dmp
    Filesize

    248KB

    Download