General
-
Target
https://tracker.usemoney.xyz/zero?cep=0INPp9du4Bhy2Xz68yYOO6a5ujZtlV9xjhCnT4cUZDhJTx-jvv2D7Xi7jVwUhpJlo52vu4233Dm8ltmYLtJBfRge5Y4P62wXpwlT5acD4EDeDh7SM9D2zGMogvUYSihxAPb3O-SGVz12pJSSOF_GkBl1TKhEvSdp2oFvg7mVhJ0JNv3-cJSDfq9kxqE8b3I2YY5ooRjr2_qD7697Z8O4qWS9CvsZsz3GdP2JCZHBd6eW1OW2yHbz1qmvA2USlnAwDkR7WL6G3w4S4IuDzYz8FzCYvEWcPp7pgD3Dt6xrsNTTCyeKXpNBsDVCSIMJ9La8Hv-IXSYDztDY64Kx35t8o7h5Bl2a5jQ9ggtADAWfMvI
-
Sample
201116-szw4la68y6
Static task
static1
URLScan task
urlscan1
Sample
https://tracker.usemoney.xyz/zero?cep=0INPp9du4Bhy2Xz68yYOO6a5ujZtlV9xjhCnT4cUZDhJTx-jvv2D7Xi7jVwUhpJlo52vu4233Dm8ltmYLtJBfRge5Y4P62wXpwlT5acD4EDeDh7SM9D2zGMogvUYSihxAPb3O-SGVz12pJSSOF_GkBl1TKhEvSdp2oFvg7mVhJ0JNv3-cJSDfq9kxqE8b3I2YY5ooRjr2_qD7697Z8O4qWS9CvsZsz3GdP2JCZHBd6eW1OW2yHbz1qmvA2USlnAwDkR7WL6G3w4S4IuDzYz8FzCYvEWcPp7pgD3Dt6xrsNTTCyeKXpNBsDVCSIMJ9La8Hv-IXSYDztDY64Kx35t8o7h5Bl2a5jQ9ggtADAWfMvI
Behavioral task
behavioral1
Sample
https://tracker.usemoney.xyz/zero?cep=0INPp9du4Bhy2Xz68yYOO6a5ujZtlV9xjhCnT4cUZDhJTx-jvv2D7Xi7jVwUhpJlo52vu4233Dm8ltmYLtJBfRge5Y4P62wXpwlT5acD4EDeDh7SM9D2zGMogvUYSihxAPb3O-SGVz12pJSSOF_GkBl1TKhEvSdp2oFvg7mVhJ0JNv3-cJSDfq9kxqE8b3I2YY5ooRjr2_qD7697Z8O4qWS9CvsZsz3GdP2JCZHBd6eW1OW2yHbz1qmvA2USlnAwDkR7WL6G3w4S4IuDzYz8FzCYvEWcPp7pgD3Dt6xrsNTTCyeKXpNBsDVCSIMJ9La8Hv-IXSYDztDY64Kx35t8o7h5Bl2a5jQ9ggtADAWfMvI
Resource
win7v20201028
Behavioral task
behavioral2
Sample
https://tracker.usemoney.xyz/zero?cep=0INPp9du4Bhy2Xz68yYOO6a5ujZtlV9xjhCnT4cUZDhJTx-jvv2D7Xi7jVwUhpJlo52vu4233Dm8ltmYLtJBfRge5Y4P62wXpwlT5acD4EDeDh7SM9D2zGMogvUYSihxAPb3O-SGVz12pJSSOF_GkBl1TKhEvSdp2oFvg7mVhJ0JNv3-cJSDfq9kxqE8b3I2YY5ooRjr2_qD7697Z8O4qWS9CvsZsz3GdP2JCZHBd6eW1OW2yHbz1qmvA2USlnAwDkR7WL6G3w4S4IuDzYz8FzCYvEWcPp7pgD3Dt6xrsNTTCyeKXpNBsDVCSIMJ9La8Hv-IXSYDztDY64Kx35t8o7h5Bl2a5jQ9ggtADAWfMvI
Resource
win7v20201028
Malware Config
Extracted
dridex
10111
194.150.118.7:443
49.212.179.180:3889
69.64.62.4:4443
Targets
-
-
Target
https://tracker.usemoney.xyz/zero?cep=0INPp9du4Bhy2Xz68yYOO6a5ujZtlV9xjhCnT4cUZDhJTx-jvv2D7Xi7jVwUhpJlo52vu4233Dm8ltmYLtJBfRge5Y4P62wXpwlT5acD4EDeDh7SM9D2zGMogvUYSihxAPb3O-SGVz12pJSSOF_GkBl1TKhEvSdp2oFvg7mVhJ0JNv3-cJSDfq9kxqE8b3I2YY5ooRjr2_qD7697Z8O4qWS9CvsZsz3GdP2JCZHBd6eW1OW2yHbz1qmvA2USlnAwDkR7WL6G3w4S4IuDzYz8FzCYvEWcPp7pgD3Dt6xrsNTTCyeKXpNBsDVCSIMJ9La8Hv-IXSYDztDY64Kx35t8o7h5Bl2a5jQ9ggtADAWfMvI
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-