Analysis
-
max time kernel
15s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-02-2021 04:41
Behavioral task
behavioral1
Sample
ffd6ae5e716b2cade6d3365fb9440a5a67f37d3c249d78bdea9e5ef3d39ce52c.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
ffd6ae5e716b2cade6d3365fb9440a5a67f37d3c249d78bdea9e5ef3d39ce52c.exe
-
Size
1.3MB
-
MD5
86954f76b5c0fbb1cb6ea492711869e2
-
SHA1
081e3460fc0c6e6e6cd1b17b4a8f6b949a88db02
-
SHA256
ffd6ae5e716b2cade6d3365fb9440a5a67f37d3c249d78bdea9e5ef3d39ce52c
-
SHA512
4b77cff3caf6966c50bcde7185173ae5c536058e1cd29d05bf439b6021572d856e40af547f22270c7c91bd13aaf3f76941eab9bc298a52724e965067d9825e69
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
188.165.17.91:8443
185.216.27.185:8172
182.254.209.230:6516
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/636-2-0x0000000000400000-0x000000000043D000-memory.dmp dridex_ldr behavioral2/memory/636-4-0x0000000000400000-0x000000000043D000-memory.dmp dridex_ldr -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
ffd6ae5e716b2cade6d3365fb9440a5a67f37d3c249d78bdea9e5ef3d39ce52c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ffd6ae5e716b2cade6d3365fb9440a5a67f37d3c249d78bdea9e5ef3d39ce52c.exe