Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    51s
  • max time network
    68s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    27-05-2022 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    389d21fc20160a91cbe2d82cf6202cdaae8e61cdca532b9da6c79cd030c35c14.exe

  • Size

    392KB

  • MD5

    95d88c941ed1fd20836fe2140bc63a55

  • SHA1

    8568e5032cb82c8bcc0e97fb6f366401c31e0e2c

  • SHA256

    389d21fc20160a91cbe2d82cf6202cdaae8e61cdca532b9da6c79cd030c35c14

  • SHA512

    e0abd1cd5dd81ba03ecb03c549548e57d2f5d98a38c17ff9c12e59d456318f3f5c194256fe834b5043c225e8a189103cdd68ecfeae1c6423a8372dc6b9bb7d45

Score
10/10
redlinetopdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

top

C2

185.215.113.75:81

Attributes
  • auth_value

    ff6259bc2baf33b54b454aad484fb0ee

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\389d21fc20160a91cbe2d82cf6202cdaae8e61cdca532b9da6c79cd030c35c14.exe
    "C:\Users\Admin\AppData\Local\Temp\389d21fc20160a91cbe2d82cf6202cdaae8e61cdca532b9da6c79cd030c35c14.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3420-117-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-118-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-119-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-120-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-121-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-122-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-123-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-124-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-125-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-126-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-127-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-128-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-129-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-130-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-131-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-132-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-134-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-135-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-136-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-137-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-138-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-139-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-140-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-141-0x0000000000930000-0x00000000009DE000-memory.dmp
    Filesize

    696KB

    Download
  • memory/3420-142-0x0000000002530000-0x0000000002567000-memory.dmp
    Filesize

    220KB

    Download
  • memory/3420-143-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-144-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-145-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-146-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-147-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-148-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-149-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-150-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-151-0x0000000000400000-0x000000000092B000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3420-152-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-153-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-154-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-155-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-156-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-157-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-158-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-159-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-160-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-161-0x00000000026F0000-0x0000000002720000-memory.dmp
    Filesize

    192KB

    Download
  • memory/3420-162-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-163-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-164-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-165-0x0000000071B50000-0x0000000072EDF000-memory.dmp
    Filesize

    19.6MB

    Download
  • memory/3420-166-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-167-0x0000000005180000-0x000000000567E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3420-168-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-169-0x0000000002960000-0x000000000298E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/3420-170-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-171-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-172-0x0000000071030000-0x0000000071A40000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/3420-173-0x0000000005C90000-0x0000000006296000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3420-174-0x0000000002C60000-0x0000000002C72000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3420-175-0x0000000005680000-0x000000000578A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3420-176-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-177-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-178-0x0000000002C80000-0x0000000002CBE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3420-179-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-180-0x0000000070D70000-0x000000007102B000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/3420-181-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-183-0x0000000070630000-0x0000000070D6E000-memory.dmp
    Filesize

    7.2MB

    Download
  • memory/3420-182-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-184-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-185-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-186-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-187-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-188-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-189-0x000000006FE50000-0x0000000070630000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3420-190-0x000000006FD50000-0x000000006FE4C000-memory.dmp
    Filesize

    1008KB

    Download
  • memory/3420-191-0x0000000005790000-0x00000000057DB000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3420-192-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-193-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-194-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-195-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-196-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-197-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-198-0x0000000000930000-0x00000000009DE000-memory.dmp
    Filesize

    696KB

    Download
  • memory/3420-199-0x0000000002530000-0x0000000002567000-memory.dmp
    Filesize

    220KB

    Download
  • memory/3420-200-0x0000000076EE0000-0x000000007706E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3420-217-0x0000000006B10000-0x0000000006B86000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3420-218-0x0000000006B90000-0x0000000006C22000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3420-221-0x0000000006D80000-0x0000000006D9E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3420-222-0x0000000006E40000-0x0000000006EA6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3420-224-0x0000000071B50000-0x0000000072EDF000-memory.dmp
    Filesize

    19.6MB

    Download
  • memory/3420-231-0x0000000071030000-0x0000000071A40000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/3420-232-0x0000000070D70000-0x000000007102B000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/3420-233-0x0000000070630000-0x0000000070D6E000-memory.dmp
    Filesize

    7.2MB

    Download
  • memory/3420-234-0x000000006FE50000-0x0000000070630000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3420-235-0x000000006FD50000-0x000000006FE4C000-memory.dmp
    Filesize

    1008KB

    Download
  • memory/3420-236-0x0000000007290000-0x0000000007452000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3420-237-0x0000000007460000-0x000000000798C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3420-241-0x0000000000400000-0x000000000092B000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3420-242-0x0000000071B50000-0x0000000072EDF000-memory.dmp
    Filesize

    19.6MB

    Download
  • memory/3420-243-0x0000000071030000-0x0000000071A40000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/3420-244-0x000000006FE50000-0x0000000070630000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3420-245-0x0000000070D70000-0x000000007102B000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/3420-246-0x0000000070630000-0x0000000070D6E000-memory.dmp
    Filesize

    7.2MB

    Download