Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    102s
  • max time network
    104s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-11-2022 13:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    558e19403ee263bb51b7f77bf32048309935a8237b2e15435b3292455aacbc0f.exe

  • Size

    341KB

  • MD5

    f74b8a26c17f34e9d2fab601a89f45e0

  • SHA1

    2fd3ee8afe9dded48f389ebfff16327123565817

  • SHA256

    558e19403ee263bb51b7f77bf32048309935a8237b2e15435b3292455aacbc0f

  • SHA512

    709579aae3d26e7752fb55ed86a982c8a050d00d818ed5e3a7f55073f48079f8cb213343f59ff539982560223a7dcaa5f313ba731c391f848a2fe7033f192cda

  • SSDEEP

    6144:PDFLG5aXiojydFsWlxfblKxu2BiM1Eo9/4J80f4XNjMv9hMOu1:P5C5aXioOnbxfE0+iaNR4Fg9e9Z

Score
10/10
redlineneruzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

neruzki

C2

193.106.191.22:47242

Attributes
  • auth_value

    be14ae67c6dd227f622680a27ea42452

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\558e19403ee263bb51b7f77bf32048309935a8237b2e15435b3292455aacbc0f.exe
    "C:\Users\Admin\AppData\Local\Temp\558e19403ee263bb51b7f77bf32048309935a8237b2e15435b3292455aacbc0f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3516

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-124-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-125-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-126-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-127-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-128-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-129-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-130-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-132-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-133-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-134-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-135-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-136-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-137-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-138-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-140-0x0000000000680000-0x00000000007CA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3516-139-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-141-0x0000000000680000-0x00000000007CA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3516-142-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-143-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-144-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-145-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-146-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-147-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-148-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-149-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-150-0x0000000000400000-0x00000000005B0000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/3516-151-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-153-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-152-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-154-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-155-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-156-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-157-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-158-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-159-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-160-0x0000000004C00000-0x0000000004C4C000-memory.dmp
    Filesize

    304KB

    Download
  • memory/3516-161-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-162-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-163-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-164-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-165-0x0000000004DF0000-0x00000000052EE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3516-166-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-167-0x0000000004C70000-0x0000000004CB8000-memory.dmp
    Filesize

    288KB

    Download
  • memory/3516-168-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-169-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-170-0x00000000052F0000-0x00000000058F6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3516-171-0x0000000004D70000-0x0000000004D82000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3516-172-0x0000000005900000-0x0000000005A0A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3516-173-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-174-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-175-0x0000000004DA0000-0x0000000004DDE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3516-176-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-177-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-178-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-179-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-180-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-181-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-182-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-183-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-184-0x0000000005A60000-0x0000000005AAB000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3516-185-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-186-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-187-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-188-0x0000000005CF0000-0x0000000005D82000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3516-189-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-190-0x0000000005D90000-0x0000000005DF6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3516-191-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-192-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-193-0x0000000077C90000-0x0000000077E1E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3516-198-0x0000000006470000-0x0000000006632000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3516-199-0x0000000006640000-0x0000000006B6C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3516-202-0x0000000000680000-0x00000000007CA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3516-203-0x0000000000680000-0x00000000007CA000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/3516-204-0x0000000006DB0000-0x0000000006E26000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3516-205-0x0000000006E40000-0x0000000006E5E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3516-207-0x0000000000400000-0x00000000005B0000-memory.dmp
    Filesize

    1.7MB

    Download