Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    51s
  • max time network
    67s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    26-05-2022 15:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10178bf1a33dde489d58b739550a686048a6c97c105bd62f47285ddd9d50e223.exe

  • Size

    301KB

  • MD5

    bae226f40c3ce0aaf4f1da1fb15da342

  • SHA1

    da926afee27a8d5b618299b4a98b22ae1787bbd5

  • SHA256

    10178bf1a33dde489d58b739550a686048a6c97c105bd62f47285ddd9d50e223

  • SHA512

    f3887e32b1fb7ee094e1a9128719089227190bfdbb8b68f81204034db523544e8f24f714958997aff6b35a3c2bae0139791fb776999a4eda5401b3e2110d8ca1

Score
10/10
redlineruzkiunikalnodiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

RuzkiUNIKALNO

C2

193.233.48.58:38989

Attributes
  • auth_value

    c504b04cfbdd4bf85ce6195bcb37fba6

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10178bf1a33dde489d58b739550a686048a6c97c105bd62f47285ddd9d50e223.exe
    "C:\Users\Admin\AppData\Local\Temp\10178bf1a33dde489d58b739550a686048a6c97c105bd62f47285ddd9d50e223.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3420-117-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-118-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-119-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-120-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-121-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-122-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-123-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-124-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-125-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-126-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-127-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-128-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-129-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-130-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-131-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-132-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-133-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-134-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-135-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-136-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-137-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-138-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-139-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-140-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-141-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-142-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-143-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-144-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-145-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-146-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-147-0x000000000085A000-0x0000000000886000-memory.dmp
    Filesize

    176KB

    Download
  • memory/3420-148-0x00000000007E0000-0x000000000081A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/3420-149-0x0000000000400000-0x0000000000453000-memory.dmp
    Filesize

    332KB

    Download
  • memory/3420-150-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-151-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-152-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-153-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-154-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-155-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-156-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-157-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-158-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-159-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-160-0x0000000002410000-0x0000000002444000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3420-161-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-162-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-163-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-164-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-165-0x0000000004CE0000-0x00000000051DE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3420-166-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-167-0x00000000024D0000-0x0000000002504000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3420-168-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-169-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-170-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-171-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-172-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-173-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-174-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-175-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-176-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-177-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-178-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-179-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-180-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-181-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-182-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-183-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-184-0x00000000057F0000-0x0000000005DF6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3420-185-0x0000000004BE0000-0x0000000004BF2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3420-186-0x00000000051E0000-0x00000000052EA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3420-187-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-188-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-189-0x0000000004C30000-0x0000000004C6E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3420-190-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-191-0x00000000053F0000-0x000000000543B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3420-196-0x0000000005550000-0x00000000055B6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3420-204-0x0000000006200000-0x0000000006276000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3420-205-0x00000000062B0000-0x0000000006342000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3420-208-0x00000000064E0000-0x00000000064FE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3420-209-0x00000000065F0000-0x00000000067B2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3420-210-0x00000000067C0000-0x0000000006CEC000-memory.dmp
    Filesize

    5.2MB

    Download