Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Analysis

  • max time kernel
    57s
  • max time network
    59s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-03-2023 07:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d31c6bb462d823c9308a16fcf6842cf39d68406e9701081fdd869a1f69ae4409.exe

  • Size

    376KB

  • MD5

    087bf72cccfd8c865940dc6a51284828

  • SHA1

    609b83cd903bc345801d8a86d5d74d828e79c239

  • SHA256

    d31c6bb462d823c9308a16fcf6842cf39d68406e9701081fdd869a1f69ae4409

  • SHA512

    0841ad16510c9f5c3740232daab1ef643e7438f203bb225e24a33378bfd24a20b011a784817674f4173b3e6446c86c2e41b31a33830b05ca95186ee150b9fb49

  • SSDEEP

    6144:9VIs9M/TWoX5cMe4tpd8QBDEFCixXB/xmuaUno9ATSb6a:9VIs9MrWuQ4tj8Q2Zxx/xmB6No

Score
10/10
redline@germanydiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@Germany

C2

185.11.61.125:22344

Attributes
  • auth_value

    9d15d78194367a949e54a07d6ce02c62

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 35 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d31c6bb462d823c9308a16fcf6842cf39d68406e9701081fdd869a1f69ae4409.exe
    "C:\Users\Admin\AppData\Local\Temp\d31c6bb462d823c9308a16fcf6842cf39d68406e9701081fdd869a1f69ae4409.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4404-122-0x00000000048D0000-0x0000000004932000-memory.dmp
    Filesize

    392KB

    Download
  • memory/4404-123-0x0000000004C10000-0x0000000004C6A000-memory.dmp
    Filesize

    360KB

    Download
  • memory/4404-124-0x00000000073E0000-0x00000000078DE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/4404-125-0x0000000004E10000-0x0000000004E68000-memory.dmp
    Filesize

    352KB

    Download
  • memory/4404-126-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4404-127-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4404-128-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4404-129-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-130-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-132-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-134-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-136-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-138-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-140-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-142-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-144-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-146-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-148-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-150-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-152-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-154-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-156-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-158-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-160-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-162-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-164-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-166-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-168-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-170-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-172-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-176-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-178-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-174-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-180-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-182-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-184-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-186-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-188-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-190-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-192-0x0000000004E10000-0x0000000004E62000-memory.dmp
    Filesize

    328KB

    Download
  • memory/4404-919-0x00000000078E0000-0x0000000007EE6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/4404-920-0x0000000005040000-0x0000000005052000-memory.dmp
    Filesize

    72KB

    Download
  • memory/4404-921-0x0000000007EF0000-0x0000000007FFA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/4404-922-0x0000000008000000-0x000000000803E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/4404-923-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4404-924-0x0000000008170000-0x00000000081BB000-memory.dmp
    Filesize

    300KB

    Download
  • memory/4404-925-0x0000000008300000-0x0000000008366000-memory.dmp
    Filesize

    408KB

    Download
  • memory/4404-926-0x00000000089B0000-0x0000000008A42000-memory.dmp
    Filesize

    584KB

    Download
  • memory/4404-927-0x0000000008A70000-0x0000000008AE6000-memory.dmp
    Filesize

    472KB

    Download
  • memory/4404-928-0x0000000008BB0000-0x0000000008D72000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/4404-929-0x0000000008D80000-0x00000000092AC000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/4404-931-0x0000000009350000-0x000000000936E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/4404-932-0x00000000048D0000-0x0000000004932000-memory.dmp
    Filesize

    392KB

    Download
  • memory/4404-933-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4404-934-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4404-935-0x0000000005030000-0x0000000005040000-memory.dmp
    Filesize

    64KB

    Download