General
-
Target
sample20210315-01.xlsm
-
Size
40KB
-
Sample
210315-h1647bcb72
-
MD5
1573b4ec83ac67af060289a37896b0c9
-
SHA1
b95d31d6b268f4382c438ba8cdb2d6fae9e23572
-
SHA256
fd2cc0c858b7b92b32d86f7bb8a48d56798667a2bc7e75fe44f074178ea3a0d6
-
SHA512
925e02a2f062cf4732335b28765779973d6db9d89c52016326aef577b0e76ee07bb8beb386545f9551aa2e4c811f6d432c9dda90cfedc6e0ed72f042808fd3b9
Behavioral task
behavioral1
Sample
sample20210315-01.xlsm
Resource
win7v20201028
Malware Config
Extracted
dridex
10444
210.65.244.184:443
147.78.186.4:10051
62.75.168.152:6601
Targets
-
-
Target
sample20210315-01.xlsm
-
Size
40KB
-
MD5
1573b4ec83ac67af060289a37896b0c9
-
SHA1
b95d31d6b268f4382c438ba8cdb2d6fae9e23572
-
SHA256
fd2cc0c858b7b92b32d86f7bb8a48d56798667a2bc7e75fe44f074178ea3a0d6
-
SHA512
925e02a2f062cf4732335b28765779973d6db9d89c52016326aef577b0e76ee07bb8beb386545f9551aa2e4c811f6d432c9dda90cfedc6e0ed72f042808fd3b9
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Loads dropped DLL
-