Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    52s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    27-06-2022 06:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    62b2a509c74c9665dff7f917d5ec2d383bcc113135cff4d9e6855b8bd62b800f.exe

  • Size

    388KB

  • MD5

    2191c72ca9f6c363e00cfaa349f99f28

  • SHA1

    7e6ae83c6022344f11175fc9556fb11f765bf769

  • SHA256

    62b2a509c74c9665dff7f917d5ec2d383bcc113135cff4d9e6855b8bd62b800f

  • SHA512

    5fc0cd434d45efb6cdea207630702ef71c825896051a4f8791aac80ac502ba7c3a7420b13a9d532b97f64c4f860c5c9f0ba948f09fd58e19cc7d2f062c07b7b3

Score
10/10
redlineruzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

RUZKI

C2

193.106.191.246:23196

Attributes
  • auth_value

    121027c094f768a0a0e9b562f6417952

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62b2a509c74c9665dff7f917d5ec2d383bcc113135cff4d9e6855b8bd62b800f.exe
    "C:\Users\Admin\AppData\Local\Temp\62b2a509c74c9665dff7f917d5ec2d383bcc113135cff4d9e6855b8bd62b800f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1492-119-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-120-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-121-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-122-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-123-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-124-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-125-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-126-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-127-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-128-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-129-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-131-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-132-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-130-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-133-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-134-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-136-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-135-0x0000000000D91000-0x0000000000DBB000-memory.dmp
    Filesize

    168KB

    Download
  • memory/1492-137-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-138-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-139-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-140-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-141-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-142-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-143-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-144-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-145-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-146-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-147-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-148-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-150-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-149-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-151-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-152-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-154-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-153-0x0000000000B60000-0x0000000000CAA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1492-155-0x0000000000400000-0x0000000000B54000-memory.dmp
    Filesize

    7.3MB

    Download
  • memory/1492-156-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-157-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-158-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-159-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-160-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-161-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-162-0x0000000002A80000-0x0000000002AB0000-memory.dmp
    Filesize

    192KB

    Download
  • memory/1492-163-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-164-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-165-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-166-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-167-0x0000000005260000-0x000000000575E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1492-168-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-169-0x0000000002C40000-0x0000000002C6E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/1492-170-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-171-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-172-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-173-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-174-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-175-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-176-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-177-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-178-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-179-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-180-0x0000000005760000-0x0000000005D66000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/1492-181-0x0000000002E50000-0x0000000002E62000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1492-182-0x0000000005D70000-0x0000000005E7A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1492-183-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-184-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-185-0x0000000002EA0000-0x0000000002EDE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/1492-186-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-187-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-188-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-191-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-192-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-190-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-189-0x0000000077820000-0x00000000779AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/1492-193-0x0000000005F80000-0x0000000005FCB000-memory.dmp
    Filesize

    300KB

    Download
  • memory/1492-197-0x0000000006120000-0x0000000006196000-memory.dmp
    Filesize

    472KB

    Download
  • memory/1492-198-0x00000000061A0000-0x0000000006232000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1492-201-0x0000000006280000-0x000000000629E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1492-203-0x0000000006430000-0x0000000006496000-memory.dmp
    Filesize

    408KB

    Download
  • memory/1492-211-0x0000000000D91000-0x0000000000DBB000-memory.dmp
    Filesize

    168KB

    Download
  • memory/1492-212-0x0000000006C50000-0x0000000006E12000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/1492-213-0x0000000006E30000-0x000000000735C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/1492-220-0x0000000000D91000-0x0000000000DBB000-memory.dmp
    Filesize

    168KB

    Download
  • memory/1492-221-0x0000000000400000-0x0000000000B54000-memory.dmp
    Filesize

    7.3MB

    Download