Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-04-2021 00:57
Static task
static1
Behavioral task
behavioral1
Sample
ig8aq.bin.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
ig8aq.bin.exe
-
Size
1.2MB
-
MD5
7c4ea65f780e48dbd15eda1a79f88a3a
-
SHA1
c30c4e608e2a2c1d8135f065fc1749acf15a28c3
-
SHA256
28fc793813f9a7430adbfe18aaac88eb121561548ad7f1133ae81ef016dc070f
-
SHA512
40e3c9ef68087a6baa27397c35dffa985d940f0264cb453c2ab7b5aea7771300401ee37e42afec7885276da656672a072ae11ef7996491159bb6e641614a0391
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
210.65.244.187:443
1.234.2.232:6601
rc4.plain
rc4.plain
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2016-115-0x0000000000400000-0x000000000052F000-memory.dmp dridex_ldr -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
ig8aq.bin.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ig8aq.bin.exe