Overview

overview

10

Static

static

8

sample2021...1.xlsm

windows7_x64

10

sample2021...1.xlsm

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample20210113-01.xlsm

  • Size

    44KB

  • Sample

    210113-cl12vw5rhn

  • MD5

    b777540ad31de24618cb9818debb2fd4

  • SHA1

    6e18fab506aefe0e1d1bdbb7bf61963075a4db61

  • SHA256

    39c47b42df4d66fe9b9e4cb03f486a6a8a11770010dd6537c55d2899b2e2021a

  • SHA512

    907ca45f11527b8446f00e79268e1f03817c0fb7097965cb69267ec82f25eeddec64651e4c2079f8a7661404549e26230ee4cd35633fda96af8f664ea0f05a68

Score
10/10
dridex10444botnetloadermacro

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://dedicace.radio-ifge.fr/p5i1wraxt.zip

Extracted

Family

dridex

Botnet

10444

C2

221.126.244.72:443

195.231.69.151:3889

157.7.166.26:5353
rc4.plain
rc4.plain

Targets

    • Target

      sample20210113-01.xlsm

    • Size

      44KB

    • MD5

      b777540ad31de24618cb9818debb2fd4

    • SHA1

      6e18fab506aefe0e1d1bdbb7bf61963075a4db61

    • SHA256

      39c47b42df4d66fe9b9e4cb03f486a6a8a11770010dd6537c55d2899b2e2021a

    • SHA512

      907ca45f11527b8446f00e79268e1f03817c0fb7097965cb69267ec82f25eeddec64651e4c2079f8a7661404549e26230ee4cd35633fda96af8f664ea0f05a68

    Score
    10/10
    dridex10444botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Loads dropped DLL

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks