Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220718-en
  • resource tags

    arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-08-2022 01:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b563494079d8f625dfd89eafb39c200ae4792e9beec553294fb6014bd61220c8.exe

  • Size

    417KB

  • MD5

    c9b5ecbffa258e754c83284f1ec2d375

  • SHA1

    82c4553df3ba1d25bb8f31d679133ccea881b962

  • SHA256

    b563494079d8f625dfd89eafb39c200ae4792e9beec553294fb6014bd61220c8

  • SHA512

    5160e424a6cde590e11803780f8ef494662047077f6a69a9097e5ad84c126b896373cae7322857a4da655bb5426434cdbf194724ac0ee48f441ac6a04df18205

Score
10/10
redlineaf2discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

AF2

C2

stcontact.top:80

Attributes
  • auth_value

    4d729a2faecb406a0eb1d6fcf30432fa

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b563494079d8f625dfd89eafb39c200ae4792e9beec553294fb6014bd61220c8.exe
    "C:\Users\Admin\AppData\Local\Temp\b563494079d8f625dfd89eafb39c200ae4792e9beec553294fb6014bd61220c8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2328-114-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-115-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-116-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-117-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-118-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-119-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-120-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-121-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-122-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-123-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-124-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-125-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-126-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-127-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-128-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-129-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-130-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-131-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-132-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-133-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-134-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-135-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-136-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-137-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-138-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-139-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-140-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-141-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-142-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-143-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-144-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-145-0x000000000074A000-0x0000000000774000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2328-146-0x0000000002250000-0x0000000002288000-memory.dmp
    Filesize

    224KB

    Download
  • memory/2328-147-0x0000000000400000-0x0000000000484000-memory.dmp
    Filesize

    528KB

    Download
  • memory/2328-148-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-150-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-149-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-151-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-152-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-153-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-154-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-155-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-156-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-157-0x0000000002340000-0x0000000002370000-memory.dmp
    Filesize

    192KB

    Download
  • memory/2328-158-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-159-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-160-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-161-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-162-0x0000000004C00000-0x00000000050FE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2328-163-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-164-0x00000000026B0000-0x00000000026E0000-memory.dmp
    Filesize

    192KB

    Download
  • memory/2328-165-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-166-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-167-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-168-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-169-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-170-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-171-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-172-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-173-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-174-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-175-0x0000000005100000-0x0000000005706000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/2328-176-0x0000000005720000-0x0000000005732000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2328-177-0x0000000005750000-0x000000000585A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2328-178-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-179-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-180-0x00000000058A0000-0x00000000058DE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2328-181-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-182-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-183-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-184-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-185-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-186-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-187-0x0000000077220000-0x00000000773AE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2328-188-0x00000000059F0000-0x0000000005A3B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/2328-206-0x000000000074A000-0x0000000000774000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2328-207-0x0000000006800000-0x0000000006876000-memory.dmp
    Filesize

    472KB

    Download
  • memory/2328-208-0x0000000006950000-0x00000000069E2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2328-211-0x0000000006910000-0x000000000692E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2328-213-0x0000000006A40000-0x0000000006AA6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2328-221-0x0000000006640000-0x0000000006690000-memory.dmp
    Filesize

    320KB

    Download
  • memory/2328-222-0x0000000006FF0000-0x00000000071B2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/2328-223-0x00000000071C0000-0x00000000076EC000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/2328-230-0x000000000074A000-0x0000000000774000-memory.dmp
    Filesize

    168KB

    Download
  • memory/2328-231-0x0000000000400000-0x0000000000484000-memory.dmp
    Filesize

    528KB

    Download