General

  • Target
    printouts of outstanding as of Jan_27_2021.xlsm
  • Size 57KB
  • Sample210127-s8s62gmxma
  • SHA256 bd0a70575336c7c295d763de9b56f4c7f4e5a8cccf7dc65798fc0dab71d129d0
  • MD5 SHA1 SHA512

Malware Config

Extracted

Language
  • xlm4.0

Source

Extracted

Family
  • dridex

Botnet
  • 10444

C2
  • 193.90.12.20:443

  • 185.181.9.76:5037

  • 175.207.13.56:5353

  • 212.129.24.84:5037

rc4.plain
rc4.plain

Targets

    • Target
      printouts of outstanding as of Jan_27_2021.xlsm
    • Size 57KB
    • SHA256 bd0a70575336c7c295d763de9b56f4c7f4e5a8cccf7dc65798fc0dab71d129d0
    • MD5 SHA1 SHA512
    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks