Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-02-2021 00:35
Behavioral task
behavioral1
Sample
djzi3.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
djzi3.bin.exe
-
Size
1.3MB
-
MD5
86954f76b5c0fbb1cb6ea492711869e2
-
SHA1
081e3460fc0c6e6e6cd1b17b4a8f6b949a88db02
-
SHA256
ffd6ae5e716b2cade6d3365fb9440a5a67f37d3c249d78bdea9e5ef3d39ce52c
-
SHA512
4b77cff3caf6966c50bcde7185173ae5c536058e1cd29d05bf439b6021572d856e40af547f22270c7c91bd13aaf3f76941eab9bc298a52724e965067d9825e69
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
188.165.17.91:8443
185.216.27.185:8172
182.254.209.230:6516
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2044-3-0x0000000000400000-0x000000000043D000-memory.dmp dridex_ldr behavioral1/memory/2044-5-0x0000000000400000-0x000000000043D000-memory.dmp dridex_ldr -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
djzi3.bin.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA djzi3.bin.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-6-0x000007FEF6510000-0x000007FEF678A000-memory.dmpFilesize
2.5MB
-
memory/2044-3-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2044-2-0x0000000075251000-0x0000000075253000-memory.dmpFilesize
8KB
-
memory/2044-4-0x0000000000220000-0x000000000025C000-memory.dmpFilesize
240KB
-
memory/2044-5-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB