Analysis
-
max time kernel
20s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 11:51
General
-
Target
0af0635495d37d661a77f1a5140cf9a5.exe
-
Size
356KB
-
MD5
b9e8580791cd59a7a0a0c017873567df
-
SHA1
fbd5dd0af7cbd794041a45a4b36ae495c5ee2190
-
SHA256
ace964d33327ba89346cb91eb8042bd095cf52893c0f9703fc104c272a6bccb0
-
SHA512
5005e287e776ce594cec47d74f0613614777e6bddc750c2ba35c71b8ac91d166170607c4a1515b5fe1993878f65521588f157709e84ac53879ed0f1581d339ab
Score
10/10
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
5.9.178.143:443
2.58.16.89:8443
37.139.2.140:3889
217.160.78.166:4664
rc4.plain
rc4.plain
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0af0635495d37d661a77f1a5140cf9a5.exe"C:\Users\Admin\AppData\Local\Temp\0af0635495d37d661a77f1a5140cf9a5.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4764-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB