Overview

overview

10

Static

static

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    63s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-02-2023 10:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58f3394fd637f0849ee49b99dd66b868c12d8386f47fd39821a0029f4b0fe5d2.exe

  • Size

    335KB

  • MD5

    ac08d04e9fafc4bf8d4ae8880dfc6736

  • SHA1

    48d5ea799400caebc1f2c572dec2813fd9e46893

  • SHA256

    58f3394fd637f0849ee49b99dd66b868c12d8386f47fd39821a0029f4b0fe5d2

  • SHA512

    1c9ccc64e43dc9148750a7ebb55f57638c18bd1a49d7e9f372a26827aa7de8191ea35b93b576a237e8bbde761880b47a6e7024cda437815a4805d526cc37cdfa

  • SSDEEP

    6144:mWgsCh9LiV+7+d4ZRewkF6CB4c0QjVzP05/cdxpx1mM8a8YH2PqXaUx7FN2:mWXU9WV+7+2eNF6CKcpjVzP05/Chlv8G

Score
10/10
redlinefredydiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

fredy

C2

62.204.41.170:4132

Attributes
  • auth_value

    880249eef9593d49a1a3cddf57c5cb35

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58f3394fd637f0849ee49b99dd66b868c12d8386f47fd39821a0029f4b0fe5d2.exe
    "C:\Users\Admin\AppData\Local\Temp\58f3394fd637f0849ee49b99dd66b868c12d8386f47fd39821a0029f4b0fe5d2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3824-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-137-0x0000000002DE8000-0x0000000002E16000-memory.dmp
    Filesize

    184KB

    Download
  • memory/3824-138-0x0000000002D30000-0x0000000002D7B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3824-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-152-0x0000000000400000-0x0000000002BBD000-memory.dmp
    Filesize

    39.7MB

    Download
  • memory/3824-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-159-0x0000000004A80000-0x0000000004AC6000-memory.dmp
    Filesize

    280KB

    Download
  • memory/3824-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-164-0x0000000007390000-0x000000000788E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3824-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-166-0x0000000007260000-0x00000000072A4000-memory.dmp
    Filesize

    272KB

    Download
  • memory/3824-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-182-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-183-0x0000000007890000-0x0000000007E96000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/3824-184-0x0000000007EA0000-0x0000000007FAA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3824-185-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-186-0x0000000007FE0000-0x0000000007FF2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3824-187-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-188-0x0000000008000000-0x000000000803E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/3824-189-0x00000000778F0000-0x0000000077A7E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3824-190-0x0000000008150000-0x000000000819B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3824-194-0x0000000002DE8000-0x0000000002E16000-memory.dmp
    Filesize

    184KB

    Download
  • memory/3824-195-0x0000000002D30000-0x0000000002D7B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/3824-196-0x0000000000400000-0x0000000002BBD000-memory.dmp
    Filesize

    39.7MB

    Download
  • memory/3824-197-0x00000000082E0000-0x0000000008372000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3824-199-0x0000000008380000-0x00000000083E6000-memory.dmp
    Filesize

    408KB

    Download
  • memory/3824-207-0x0000000008CC0000-0x0000000008D36000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3824-208-0x0000000008D40000-0x0000000008D90000-memory.dmp
    Filesize

    320KB

    Download
  • memory/3824-209-0x0000000008DA0000-0x0000000008F62000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3824-210-0x0000000008F80000-0x00000000094AC000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/3824-217-0x0000000002DE8000-0x0000000002E16000-memory.dmp
    Filesize

    184KB

    Download
  • memory/3824-218-0x0000000000400000-0x0000000002BBD000-memory.dmp
    Filesize

    39.7MB

    Download