Resubmissions
13-05-2022 06:06
220513-gt5nvscfh6 1013-05-2022 05:59
220513-gpz8ksfgbk 1030-04-2021 05:04
210430-gqhdv8yacs 10Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
30-04-2021 05:04
Static task
static1
Behavioral task
behavioral1
Sample
874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6.exe
Resource
win10v20210408
General
-
Target
874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6.exe
-
Size
1.2MB
-
MD5
395d57a0fd2e21c3f5d606c9efec83cc
-
SHA1
98747a4cbd9984170b1b0c9d7a8be269903726af
-
SHA256
874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6
-
SHA512
7abdbcb068fcb7a2f0eda3ea8d964f8a7640e8a5bb9b306552053becec13b261c9b4740eeb6936a2e3a18b307fa53c588d8e9f8d7b91e4cdf57b95588a5b4498
Malware Config
Extracted
dridex
10111
77.220.64.135:443
153.126.165.175:6601
210.65.244.183:8443
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1084-60-0x0000000000400000-0x0000000000530000-memory.dmp dridex_ldr -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 874c2077d9d9036ef76bd36bb444677a1d2a6e6aaa7f0dfdd91bd2e0972b84c6.exe