Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    55s
  • max time network
    60s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-03-2023 20:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5b1df294360dbaa288e0be318eb739ee3c3ff0d2ef0ced649a2b223d15726e8.exe

  • Size

    454KB

  • MD5

    76919b4088e0247a237db2418d9ed6bd

  • SHA1

    517f410b6dc21c593d6da8c5255b0b04cc48d3fb

  • SHA256

    a5b1df294360dbaa288e0be318eb739ee3c3ff0d2ef0ced649a2b223d15726e8

  • SHA512

    13c306edd4e46bb8b6387681542995fb053d0b0ce4f15b79ef490aa933d6ef3922ea986794f39fa5a27defcd44aac9392cefa2267c1201064a43ba84bb1c0ea7

  • SSDEEP

    6144:nuXSka5LoLXx6GQBga3PAFwXsexKwho0CJPMT2wJVnpg1W41N:dka5LoTx6GQ3IxexKQpDTXJVnpaW41

Score
10/10
redlinedozkdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes
  • auth_value

    9f1dc4ff242fb8b53742acae0ef96143

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 35 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5b1df294360dbaa288e0be318eb739ee3c3ff0d2ef0ced649a2b223d15726e8.exe
    "C:\Users\Admin\AppData\Local\Temp\a5b1df294360dbaa288e0be318eb739ee3c3ff0d2ef0ced649a2b223d15726e8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2472-122-0x00000000024B0000-0x0000000002512000-memory.dmp
    Filesize

    392KB

    Download
  • memory/2472-123-0x0000000004DE0000-0x0000000004E3A000-memory.dmp
    Filesize

    360KB

    Download
  • memory/2472-124-0x0000000004EE0000-0x00000000053DE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2472-126-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-125-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-127-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-128-0x0000000004E40000-0x0000000004E98000-memory.dmp
    Filesize

    352KB

    Download
  • memory/2472-129-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-130-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-132-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-134-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-136-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-138-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-144-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-146-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-142-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-140-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-148-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-150-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-154-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-152-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-158-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-156-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-160-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-162-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-164-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-166-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-168-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-170-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-172-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-174-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-176-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-180-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-178-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-182-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-184-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-186-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-188-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-190-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-192-0x0000000004E40000-0x0000000004E92000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2472-919-0x00000000053E0000-0x00000000059E6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/2472-920-0x0000000005A50000-0x0000000005A62000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2472-921-0x0000000005A80000-0x0000000005B8A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2472-922-0x0000000005B90000-0x0000000005BCE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2472-923-0x0000000005D20000-0x0000000005D6B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/2472-924-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-925-0x0000000005EB0000-0x0000000005F16000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2472-926-0x0000000006550000-0x00000000065E2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2472-928-0x0000000006870000-0x00000000068E6000-memory.dmp
    Filesize

    472KB

    Download
  • memory/2472-929-0x0000000006920000-0x000000000693E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2472-931-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-930-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-932-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2472-933-0x00000000069F0000-0x0000000006BB2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/2472-934-0x0000000006BC0000-0x00000000070EC000-memory.dmp
    Filesize

    5.2MB

    Download