Overview

overview

10

Static

static

10

dridex

windows10_x64

10
General
Target

4182bbe376211b016413047781db3a33845175e6e42607a96e72e35c25ebf8f8.exe

Filesize

106KB

Completed

23-03-2022 06:31

Task

behavioral1

Score
10/10
MD5

bdcda17e1b94619d730cab69ad833288

SHA1

cd2589c8bc69c75384cd0ab9df9f4c9778c6bca2

SHA256

4182bbe376211b016413047781db3a33845175e6e42607a96e72e35c25ebf8f8

SHA256

70b35a1d93a5d771b8ffcb1040619c1185150ddea32dc71ba88db3d128838f444f2e3acb9774e186e56bf7829707c290ac8ee02531ae934e8834675cad3734ed

Malware Config

Extracted

Family

redline
Botnet

1
C2

20.53.13.165:43420
Attributes
auth_value
7ed907c60301a0aea12a58314db264f5
Signatures 2

Filter: none

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/3484-114-0x0000000000690000-0x00000000006B0000-memory.dmpfamily_redline
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\4182bbe376211b016413047781db3a33845175e6e42607a96e72e35c25ebf8f8.exe
    "C:\Users\Admin\AppData\Local\Temp\4182bbe376211b016413047781db3a33845175e6e42607a96e72e35c25ebf8f8.exe"
    PID:3484
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/3484-114-0x0000000000690000-0x00000000006B0000-memory.dmp

                            Download

                          • memory/3484-115-0x0000000005410000-0x0000000005A16000-memory.dmp

                            Download

                          • memory/3484-116-0x0000000004EA0000-0x0000000004EB2000-memory.dmp

                            Download

                          • memory/3484-117-0x0000000004FD0000-0x00000000050DA000-memory.dmp

                            Download

                          • memory/3484-118-0x0000000004F30000-0x0000000004F6E000-memory.dmp

                            Download

                          • memory/3484-119-0x0000000004F70000-0x0000000004FBB000-memory.dmp

                            Download