Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    25-06-2022 18:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    679c78c95618579be0e840338e788bc36b435b865bbce589d54d527e5ba980d6.exe

  • Size

    390KB

  • MD5

    b68b05adfb7f2e4ebb788891692bbc2e

  • SHA1

    30be02b4f78c80d7cfa60bd3f3a06b49ea96d175

  • SHA256

    679c78c95618579be0e840338e788bc36b435b865bbce589d54d527e5ba980d6

  • SHA512

    3fc1ffeb219909f8e89267552114e6d1a8d12d338e2108d99fac8e794aeaf0c764d53f9358bf17e63377920d4720df398ea235b5e6c98c6d9bbaade3e2829b06

Score
10/10
redlineruzkiinfostealer

Malware Config

Extracted

Family

redline

Botnet

RUZKI

C2

193.106.191.246:23196

Attributes
  • auth_value

    121027c094f768a0a0e9b562f6417952

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\679c78c95618579be0e840338e788bc36b435b865bbce589d54d527e5ba980d6.exe
    "C:\Users\Admin\AppData\Local\Temp\679c78c95618579be0e840338e788bc36b435b865bbce589d54d527e5ba980d6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1888-117-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-118-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-119-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-120-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-121-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-122-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-123-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-125-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-126-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-127-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-128-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-129-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-130-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-131-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-132-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-133-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-134-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-135-0x0000000000B60000-0x0000000000CAA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1888-136-0x0000000002780000-0x00000000027B7000-memory.dmp
    Filesize

    220KB

    Download
  • memory/1888-137-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-138-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-139-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-140-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-141-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-142-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-143-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-144-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-145-0x0000000000400000-0x0000000000B54000-memory.dmp
    Filesize

    7.3MB

    Download
  • memory/1888-146-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-147-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-148-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-149-0x0000000000B60000-0x0000000000CAA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1888-150-0x0000000002780000-0x00000000027B7000-memory.dmp
    Filesize

    220KB

    Download
  • memory/1888-151-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-152-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-153-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-154-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-155-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-156-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-157-0x0000000000400000-0x0000000000B54000-memory.dmp
    Filesize

    7.3MB

    Download
  • memory/1888-158-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-159-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-160-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-161-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-162-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-163-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-164-0x0000000002BC0000-0x0000000002BF0000-memory.dmp
    Filesize

    192KB

    Download
  • memory/1888-165-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-166-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-167-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-168-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-169-0x0000000005100000-0x00000000055FE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1888-170-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-171-0x0000000005840000-0x000000000586E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/1888-172-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-173-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-174-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-175-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-176-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-177-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-178-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-179-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-180-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-181-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-182-0x00000000058A0000-0x0000000005EA6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/1888-183-0x0000000005F30000-0x0000000005F42000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1888-184-0x0000000005F60000-0x000000000606A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1888-185-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-186-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-187-0x0000000006090000-0x00000000060CE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1888-188-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-189-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-190-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-191-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-192-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-193-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-194-0x0000000077330000-0x00000000774BE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1888-195-0x0000000006200000-0x000000000624B000-memory.dmp
    Filesize

    300KB

    Download