Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    52s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    30-05-2022 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    205e14910235515a528a5439508d771bcd5f23f217cecec56538c17b5cb61dff.exe

  • Size

    414KB

  • MD5

    d88acea234db567fb1852c3a3f6de187

  • SHA1

    4ebcba46e6bf7609e37a2af7082d1d0089b51472

  • SHA256

    205e14910235515a528a5439508d771bcd5f23f217cecec56538c17b5cb61dff

  • SHA512

    6b12760e449412a51c5a7aeb96682a35d652fdde0976d25ddb19547c51cca6962eae19feaf1f6b7029120cf0ba6f7aa1da44eeaa74ba80293fe807c0dca9d9e7

Score
10/10
redlineruzkiunikalnodiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

RuzkiUNIKALNO

C2

193.233.48.58:38989

Attributes
  • auth_value

    c504b04cfbdd4bf85ce6195bcb37fba6

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\205e14910235515a528a5439508d771bcd5f23f217cecec56538c17b5cb61dff.exe
    "C:\Users\Admin\AppData\Local\Temp\205e14910235515a528a5439508d771bcd5f23f217cecec56538c17b5cb61dff.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3064-117-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-118-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-119-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-120-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-121-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-122-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-123-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-124-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-125-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-126-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-127-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-128-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-129-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-130-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-131-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-132-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-133-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-134-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-135-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-136-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-138-0x0000000000891000-0x00000000008BD000-memory.dmp
    Filesize

    176KB

    Download
  • memory/3064-140-0x0000000000510000-0x000000000065A000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3064-141-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-139-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-142-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-143-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-137-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-144-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-145-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-146-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-147-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-148-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-149-0x0000000000400000-0x000000000050D000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/3064-150-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-151-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-153-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-152-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-154-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-155-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-156-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-157-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-158-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-159-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-160-0x00000000025D0000-0x0000000002604000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3064-161-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-162-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-163-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-164-0x0000000071E10000-0x000000007319F000-memory.dmp
    Filesize

    19.6MB

    Download
  • memory/3064-165-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-166-0x0000000004D70000-0x000000000526E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3064-167-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-168-0x0000000004BC0000-0x0000000004BF4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3064-169-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-170-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-171-0x00000000712F0000-0x0000000071D00000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/3064-172-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-173-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-174-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-175-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-176-0x0000000070B10000-0x00000000712F0000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3064-177-0x0000000070710000-0x0000000070B03000-memory.dmp
    Filesize

    3.9MB

    Download
  • memory/3064-178-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-179-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-181-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-180-0x000000006FB60000-0x000000007070E000-memory.dmp
    Filesize

    11.7MB

    Download
  • memory/3064-182-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-183-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-184-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-185-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-186-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-187-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-188-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-189-0x0000000005270000-0x0000000005876000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3064-190-0x0000000004C90000-0x0000000004CA2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3064-191-0x000000006E850000-0x000000006FB57000-memory.dmp
    Filesize

    19.0MB

    Download
  • memory/3064-192-0x0000000005880000-0x000000000598A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3064-193-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-194-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-195-0x0000000004D20000-0x0000000004D5E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3064-196-0x00000000771A0000-0x000000007732E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3064-197-0x0000000005A90000-0x0000000005ADB000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3064-199-0x000000006E0A0000-0x000000006E35B000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/3064-200-0x000000006D960000-0x000000006E09E000-memory.dmp
    Filesize

    7.2MB

    Download
  • memory/3064-201-0x000000006D860000-0x000000006D95C000-memory.dmp
    Filesize

    1008KB

    Download
  • memory/3064-204-0x0000000000891000-0x00000000008BD000-memory.dmp
    Filesize

    176KB

    Download
  • memory/3064-205-0x0000000000510000-0x000000000065A000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3064-207-0x0000000005C10000-0x0000000005C76000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3064-214-0x0000000071E10000-0x000000007319F000-memory.dmp
    Filesize

    19.6MB

    Download
  • memory/3064-216-0x00000000062B0000-0x0000000006326000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3064-217-0x0000000006370000-0x0000000006402000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3064-220-0x0000000006570000-0x000000000658E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3064-221-0x00000000712F0000-0x0000000071D00000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/3064-222-0x0000000070B10000-0x00000000712F0000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3064-223-0x0000000070710000-0x0000000070B03000-memory.dmp
    Filesize

    3.9MB

    Download
  • memory/3064-224-0x000000006FB60000-0x000000007070E000-memory.dmp
    Filesize

    11.7MB

    Download
  • memory/3064-225-0x000000006E0A0000-0x000000006E35B000-memory.dmp
    Filesize

    2.7MB

    Download
  • memory/3064-226-0x000000006D960000-0x000000006E09E000-memory.dmp
    Filesize

    7.2MB

    Download
  • memory/3064-227-0x000000006D860000-0x000000006D95C000-memory.dmp
    Filesize

    1008KB

    Download
  • memory/3064-228-0x00000000066A0000-0x0000000006862000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3064-229-0x0000000006870000-0x0000000006D9C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3064-236-0x0000000000891000-0x00000000008BD000-memory.dmp
    Filesize

    176KB

    Download
  • memory/3064-237-0x0000000000400000-0x000000000050D000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/3064-238-0x0000000071E10000-0x000000007319F000-memory.dmp
    Filesize

    19.6MB

    Download
  • memory/3064-239-0x00000000712F0000-0x0000000071D00000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/3064-240-0x000000006FB60000-0x000000007070E000-memory.dmp
    Filesize

    11.7MB

    Download
  • memory/3064-241-0x0000000070B10000-0x00000000712F0000-memory.dmp
    Filesize

    7.9MB

    Download
  • memory/3064-242-0x000000006E0A0000-0x000000006E35B000-memory.dmp
    Filesize

    2.7MB

    Download