Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    85s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-03-2023 10:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d28e4334d33820fbdf5779c3b0ccaf6252ae4324a21d6a54692541992c46cc56.exe

  • Size

    352KB

  • MD5

    61c80a69fffd0c0edd2e1bc2b2684ea5

  • SHA1

    7d87efb42c20223822fc59fb4451ab6bd4ad22cb

  • SHA256

    d28e4334d33820fbdf5779c3b0ccaf6252ae4324a21d6a54692541992c46cc56

  • SHA512

    a397f2d51fa935499e5ebbfa65f1b218fca41bb2f470373a8d999951937ff2e4de2d4af01db0a1560c0aba8cc0dbfed42a2090819e260999bc98bca68067f559

  • SSDEEP

    3072:rqH1z4N37y1dd8ATtYD0uDsSEz47LFOl9gyyS7D29OfODJIp+Ai+rkhWHVdi4eqo:VwNPiCZk/F0f7/bo2Hne+dom6mj

Score
10/10
redlinedozkdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

dozk

C2

91.215.85.15:25916

Attributes
  • auth_value

    9f1dc4ff242fb8b53742acae0ef96143

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 33 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d28e4334d33820fbdf5779c3b0ccaf6252ae4324a21d6a54692541992c46cc56.exe
    "C:\Users\Admin\AppData\Local\Temp\d28e4334d33820fbdf5779c3b0ccaf6252ae4324a21d6a54692541992c46cc56.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1916
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 1224
      2⤵
      • Program crash
      PID:436
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1916 -ip 1916
    1⤵
      PID:452

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1916-134-0x00000000047B0000-0x0000000004812000-memory.dmp
      Filesize

      392KB

      Download
    • memory/1916-135-0x00000000074B0000-0x00000000074C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1916-136-0x00000000074C0000-0x0000000007A64000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/1916-137-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-138-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-140-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-142-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-144-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-146-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-148-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-150-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-156-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-154-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-158-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-152-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-160-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-162-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-164-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-166-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-173-0x00000000074B0000-0x00000000074C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1916-172-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-176-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-175-0x00000000074B0000-0x00000000074C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1916-170-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-168-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-178-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-180-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-184-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-186-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-182-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-190-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-192-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-188-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-202-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-200-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-198-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-196-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-194-0x0000000004E70000-0x0000000004EC2000-memory.dmp
      Filesize

      328KB

      Download
    • memory/1916-929-0x0000000007A70000-0x0000000008088000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/1916-930-0x00000000073D0000-0x00000000073E2000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1916-931-0x0000000008090000-0x000000000819A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1916-932-0x00000000073F0000-0x000000000742C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/1916-933-0x00000000074B0000-0x00000000074C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1916-934-0x00000000082F0000-0x0000000008356000-memory.dmp
      Filesize

      408KB

      Download
    • memory/1916-935-0x0000000008BC0000-0x0000000008C52000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1916-936-0x0000000008C70000-0x0000000008CE6000-memory.dmp
      Filesize

      472KB

      Download
    • memory/1916-937-0x0000000008D50000-0x0000000008F12000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/1916-938-0x0000000008F30000-0x000000000945C000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/1916-939-0x0000000009570000-0x000000000958E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/1916-941-0x00000000074B0000-0x00000000074C0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1916-943-0x00000000074B0000-0x00000000074C0000-memory.dmp
      Filesize

      64KB

      Download