Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    79s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2023 13:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46e89ce114403c52df32174d757f702389c3e265069a09ee2b57bbb3ef4eb39f.exe

  • Size

    346KB

  • MD5

    9381d4c6c97aec22036ba0db0fdc29ff

  • SHA1

    2c02f0548ed065bf5ffc4f819eab4b3370b89542

  • SHA256

    46e89ce114403c52df32174d757f702389c3e265069a09ee2b57bbb3ef4eb39f

  • SHA512

    13467c1aa944fbfe368c76cba90b8ba76b961f08e91e1141b4126528f8f1b9d319969ecfdac2d56bb6b2d69b47d47cbf688c4303e1e1f20ded0d1398dfa33866

  • SSDEEP

    6144:4347L+L+66wZIUIjKtUgdyI8nHo/4HC4nI9Kb+blDIwphSo:J7L+S66wyfj70KCP9h5fhb

Score
10/10
redlinedozkdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes
  • auth_value

    9f1dc4ff242fb8b53742acae0ef96143

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 33 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46e89ce114403c52df32174d757f702389c3e265069a09ee2b57bbb3ef4eb39f.exe
    "C:\Users\Admin\AppData\Local\Temp\46e89ce114403c52df32174d757f702389c3e265069a09ee2b57bbb3ef4eb39f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1252
      2⤵
      • Program crash
      PID:4588
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4872 -ip 4872
    1⤵
      PID:2028

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4872-134-0x0000000002490000-0x00000000024F2000-memory.dmp
      Filesize

      392KB

      Download
    • memory/4872-135-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4872-136-0x0000000004F30000-0x00000000054D4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4872-137-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-138-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-140-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-142-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-146-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4872-145-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-144-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4872-148-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-150-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-152-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-154-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-156-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-158-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-160-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-162-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-164-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-166-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-168-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-170-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-172-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-174-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-176-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-178-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-182-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-180-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-184-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-186-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-188-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-192-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-190-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-194-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-196-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-198-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-200-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-202-0x0000000004E80000-0x0000000004ED2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4872-929-0x00000000054E0000-0x0000000005AF8000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/4872-930-0x0000000005B40000-0x0000000005B52000-memory.dmp
      Filesize

      72KB

      Download
    • memory/4872-931-0x0000000005B60000-0x0000000005C6A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4872-932-0x0000000005C70000-0x0000000005CAC000-memory.dmp
      Filesize

      240KB

      Download
    • memory/4872-933-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4872-934-0x0000000005F80000-0x0000000005FE6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4872-935-0x0000000006650000-0x00000000066E2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4872-936-0x0000000006700000-0x0000000006776000-memory.dmp
      Filesize

      472KB

      Download
    • memory/4872-937-0x00000000067C0000-0x00000000067DE000-memory.dmp
      Filesize

      120KB

      Download
    • memory/4872-938-0x0000000006980000-0x0000000006B42000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/4872-939-0x0000000006B60000-0x000000000708C000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/4872-941-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4872-943-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4872-944-0x0000000004F20000-0x0000000004F30000-memory.dmp
      Filesize

      64KB

      Download