General

  • Target

    Inv.Docum_323925335.doc.zip

  • Size

    46KB

  • Sample

    201209-lpl67ry54n

  • MD5

    d9fa1bfce0b902a7f0d10c5979c34be7

  • SHA1

    1b24b85098bf54607087e35b744911f2e827c6d5

  • SHA256

    2b8b585d0084b819ea6bee74f896613e1d742bbac10a661c3097cf60e3ebd879

  • SHA512

    446064babec598e2a1c071ddf8b816569fcf75e398d67882ac195a8bbea0c257f6509558d043b146e5f68f555555042f8352776f3d1e9b48bb72770130692d4e

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://mountainceramic.com/kx8vjddb.rar

exe.dropper

http://siemensagent.com/ny2tqv.zip

exe.dropper

https://final.makkahkmcc.com/shqay5y.rar

exe.dropper

https://bhasinbrothers.com/cdy7qodb.rar

exe.dropper

https://test.chongthamsika.com.vn/jl4gs4ar.zip

exe.dropper

https://skvflexandoffset.in/igjkrk3.rar

exe.dropper

http://weedcompare.co.uk/mkcy8uttq.zip

exe.dropper

https://thisismycurrentproject.com/rtftdo.rar

Extracted

Family

dridex

Botnet

10555

C2

104.131.164.93:443

46.101.90.205:4643

27.254.174.84:4443

92.94.251.127:3786

rc4.plain
rc4.plain

Targets

    • Target

      Inv.Docum_323925335.doc

    • Size

      125KB

    • MD5

      5c444e90c7b3b1175aa3f4bf033d2ef5

    • SHA1

      66736c8bf74de6e40050f18054df455efd7ec060

    • SHA256

      7b489dd3122109c2d71b1ddfd04a0254dbaffe9585da9281c1c8d09c7051c10e

    • SHA512

      c9f3ce7123495adda27949079c32119336dc220cd3772b12de1d4d97ac16b0f86f2f29a9a28664db5abfa3d7ceb74c3bc7b23f38bb1520d4e7e403f9e3fefdd2

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Tasks