General

  • Target

    Invoice_8384252.xlsm

  • Size

    331KB

  • Sample

    210727-hrlyyq5mxe

  • MD5

    bde2b9dc7dab9e930be10b75dcd171ef

  • SHA1

    8dfeed50d89f5a2264efb31e5f74816b49c148fb

  • SHA256

    b556487ae4d889236c1626083b0c9d45a29a5c3bc4e087bf2e3245b6a18ed2db

  • SHA512

    123521549ec9d98f62929ed40357be1c341bc799e79bc322a4bda0e524b297161021fec6bb16b60043d5f2cf575d9e7abdae5e45ba9db4f058009702963beac8

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

45.79.33.48:443

139.162.202.74:5007

68.183.216.174:7443

rc4.plain
rc4.plain

Targets

    • Target

      Invoice_8384252.xlsm

    • Size

      331KB

    • MD5

      bde2b9dc7dab9e930be10b75dcd171ef

    • SHA1

      8dfeed50d89f5a2264efb31e5f74816b49c148fb

    • SHA256

      b556487ae4d889236c1626083b0c9d45a29a5c3bc4e087bf2e3245b6a18ed2db

    • SHA512

      123521549ec9d98f62929ed40357be1c341bc799e79bc322a4bda0e524b297161021fec6bb16b60043d5f2cf575d9e7abdae5e45ba9db4f058009702963beac8

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks