General

  • Target

    Inv.Docum.559488870.doc

  • Size

    215KB

  • Sample

    201208-7fnyymrczs

  • MD5

    00a2b86ce0838d196772467738cbf883

  • SHA1

    fd9d7e35c7b1ad644d1970bb6ac4e184171486f4

  • SHA256

    0144312afb25e3dbef3ef44e2802c3bbd93527eea90ea8d325c7e8193e57d9c4

  • SHA512

    da97703e140912d396a950aad0a971fb6cd6e0f2e27d29a8009048b8cd29a9f3ee8c87e886dd460f915ada9235152168666c0556b148bfa4d9d306fe8eadeb3a

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://findqualityparts.com/kr44dt.zip

exe.dropper

https://saelectronicstrading.com/dekkp2ciq.zip

exe.dropper

http://loftkultur.binkhalidinternational.com/hh7lww450.zip

exe.dropper

http://excursoesdeinhamais.resultaweb.com.br/edyk3dbr.zip

exe.dropper

http://vibeautospa.com/xm9d9i.zip

exe.dropper

https://greeninvestconsulting.com/c51qtl1uf.zip

exe.dropper

https://owl-squad.com/icg2mmdqx.zip

Extracted

Family

dridex

Botnet

10555

C2

104.131.164.93:443

46.101.90.205:4643

27.254.174.84:4443

92.94.251.127:3786

rc4.plain
rc4.plain

Targets

    • Target

      Inv.Docum.559488870.doc

    • Size

      215KB

    • MD5

      00a2b86ce0838d196772467738cbf883

    • SHA1

      fd9d7e35c7b1ad644d1970bb6ac4e184171486f4

    • SHA256

      0144312afb25e3dbef3ef44e2802c3bbd93527eea90ea8d325c7e8193e57d9c4

    • SHA512

      da97703e140912d396a950aad0a971fb6cd6e0f2e27d29a8009048b8cd29a9f3ee8c87e886dd460f915ada9235152168666c0556b148bfa4d9d306fe8eadeb3a

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Tasks