Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    83s
  • max time network
    86s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    17-05-2022 19:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9bb63f202e9aec579b02a622da25b3126ea992f72510de08ccbe45576bd8e3e5.exe

  • Size

    434KB

  • MD5

    5c26834732aac66b3074d0baeeb8439e

  • SHA1

    e2ebbc7d3574134fdf31c4c38e86f5ebc08796e2

  • SHA256

    9bb63f202e9aec579b02a622da25b3126ea992f72510de08ccbe45576bd8e3e5

  • SHA512

    ceea179fea28f012c694070a9cc8e5fbebc85390b6eb8f2bb59c57bf7e167d72aa80d2e50e1382c3376f2fd69be4cb334c9c14617702f16d074013d0b5332ba6

Score
10/10
redlinetest1discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

test1

C2

185.215.113.75:80

Attributes
  • auth_value

    7ab4a4e2eae9eb7ae10f64f68df53bb3

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bb63f202e9aec579b02a622da25b3126ea992f72510de08ccbe45576bd8e3e5.exe
    "C:\Users\Admin\AppData\Local\Temp\9bb63f202e9aec579b02a622da25b3126ea992f72510de08ccbe45576bd8e3e5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2492-118-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-119-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-120-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-121-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-122-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-123-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-124-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-125-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-126-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-127-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-128-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-129-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-130-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-131-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-132-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-133-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-134-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-135-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-136-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-137-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-138-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-139-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-140-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-141-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-142-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-143-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-144-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-145-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-146-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-147-0x0000000000713000-0x000000000073D000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2492-148-0x0000000000900000-0x0000000000937000-memory.dmp
    Filesize

    220KB

    Download
  • memory/2492-149-0x0000000000400000-0x00000000004AE000-memory.dmp
    Filesize

    696KB

    Download
  • memory/2492-150-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-151-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-152-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-154-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-153-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-155-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-156-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-157-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-158-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-159-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-160-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-161-0x0000000000A60000-0x0000000000A90000-memory.dmp
    Filesize

    192KB

    Download
  • memory/2492-162-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-163-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-164-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-165-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-166-0x0000000004A30000-0x0000000004F2E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2492-167-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-168-0x0000000000B10000-0x0000000000B3E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/2492-169-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-170-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-171-0x0000000004F50000-0x0000000005556000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/2492-172-0x00000000055F0000-0x0000000005602000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2492-173-0x0000000005620000-0x000000000572A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2492-174-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-175-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-176-0x0000000005730000-0x000000000576E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2492-177-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-178-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-179-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-180-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-181-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-182-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-183-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-184-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-185-0x00000000057C0000-0x000000000580B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/2492-186-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-187-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-188-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-189-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-190-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-191-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-192-0x0000000077310000-0x000000007749E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2492-209-0x0000000006520000-0x0000000006596000-memory.dmp
    Filesize

    472KB

    Download
  • memory/2492-210-0x0000000006660000-0x00000000066F2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2492-213-0x00000000065C0000-0x00000000065DE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2492-214-0x00000000068A0000-0x0000000006906000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2492-222-0x0000000006CC0000-0x0000000006E82000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/2492-223-0x0000000006EA0000-0x00000000073CC000-memory.dmp
    Filesize

    5.2MB

    Download