Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-06-2021 05:40
Behavioral task
behavioral1
Sample
a645843910112f9a5ae386ca87c03e97.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
a645843910112f9a5ae386ca87c03e97.exe
-
Size
1.0MB
-
MD5
a645843910112f9a5ae386ca87c03e97
-
SHA1
3f047cb47258dfdcea41cd443c9686cf024667ba
-
SHA256
af158f524186d5bb8f0cd61679c2c0b7a874261ae23251c45b0054789e60156e
-
SHA512
4c8447e46ecb3d3b4e06721d3288d47b35d6674334d4e2c22c562c1a4d5b65392743a9eb183dcf95f3917b754b693a152abfc2946630262f8b95ebbd2beca810
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
115.68.220.48:443
103.42.57.18:5007
95.111.235.8:13786
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a645843910112f9a5ae386ca87c03e97.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a645843910112f9a5ae386ca87c03e97.exe