Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    109s
  • platform
    windows10-1703_x64
  • resource
    win10-20220722-en
  • resource tags

    arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-08-2022 05:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8901b07aa5700153471c8934a3688f39d48b8eb55c02f6154003d4fb4856a37.exe

  • Size

    417KB

  • MD5

    ed039bc25469563a49c9de70050633fc

  • SHA1

    31ed1c67759e7dffe9f680cbed9b776b76ab3054

  • SHA256

    c8901b07aa5700153471c8934a3688f39d48b8eb55c02f6154003d4fb4856a37

  • SHA512

    b1d5fa1d5220700c6ed81b29b0a49fc9055547ce24ad2edbaf6cbca933a65b3221c8181661599468ed3fff84df2e5047b88ef69390c5a2a01413cd112bdf0eae

Score
10/10
redlineaf2discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

AF2

C2

stcontact.top:80

Attributes
  • auth_value

    4d729a2faecb406a0eb1d6fcf30432fa

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8901b07aa5700153471c8934a3688f39d48b8eb55c02f6154003d4fb4856a37.exe
    "C:\Users\Admin\AppData\Local\Temp\c8901b07aa5700153471c8934a3688f39d48b8eb55c02f6154003d4fb4856a37.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4940-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-152-0x00000000007EA000-0x0000000000814000-memory.dmp
    Filesize

    168KB

    Download
  • memory/4940-153-0x00000000021B0000-0x00000000021E8000-memory.dmp
    Filesize

    224KB

    Download
  • memory/4940-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-158-0x0000000000400000-0x0000000000484000-memory.dmp
    Filesize

    528KB

    Download
  • memory/4940-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-170-0x00000000024B0000-0x00000000024E0000-memory.dmp
    Filesize

    192KB

    Download
  • memory/4940-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-175-0x0000000004BD0000-0x00000000050CE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/4940-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-177-0x0000000004B30000-0x0000000004B60000-memory.dmp
    Filesize

    192KB

    Download
  • memory/4940-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-179-0x00000000007EA000-0x0000000000814000-memory.dmp
    Filesize

    168KB

    Download
  • memory/4940-180-0x00000000021B0000-0x00000000021E8000-memory.dmp
    Filesize

    224KB

    Download
  • memory/4940-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-182-0x0000000000400000-0x0000000000484000-memory.dmp
    Filesize

    528KB

    Download
  • memory/4940-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-185-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-186-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-187-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-188-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-189-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-190-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-191-0x00000000050D0000-0x00000000056D6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/4940-192-0x0000000005720000-0x0000000005732000-memory.dmp
    Filesize

    72KB

    Download
  • memory/4940-193-0x0000000005750000-0x000000000585A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4940-194-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-195-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-196-0x00000000058A0000-0x00000000058DE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/4940-197-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-198-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-199-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-200-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-201-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-202-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-203-0x00000000779B0000-0x0000000077B3E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/4940-204-0x00000000059F0000-0x0000000005A3B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/4940-228-0x0000000006640000-0x00000000066A6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/4940-236-0x00000000069D0000-0x0000000006A46000-memory.dmp
    Filesize

    472KB

    Download
  • memory/4940-237-0x0000000006AE0000-0x0000000006B72000-memory.dmp
    Filesize

    584KB

    Download
  • memory/4940-240-0x0000000006A90000-0x0000000006AAE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/4940-241-0x0000000006D00000-0x0000000006D50000-memory.dmp
    Filesize

    320KB

    Download
  • memory/4940-242-0x0000000006D70000-0x0000000006F32000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/4940-243-0x0000000006F40000-0x000000000746C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/4940-250-0x00000000007EA000-0x0000000000814000-memory.dmp
    Filesize

    168KB

    Download
  • memory/4940-251-0x0000000000400000-0x0000000000484000-memory.dmp
    Filesize

    528KB

    Download