General
Static task
static1
URLScan task
urlscan1
Sample
https://cdn.discordapp.com/attachments/869191622208925709/869213951068614656/Invoice_3326809.xlsm
Malware Config
Extracted
Family
dridex
Botnet
22202
C2
45.79.33.48:443
139.162.202.74:5007
68.183.216.174:7443
rc4.plain
rc4.plain
Targets
-
-
Target
https://cdn.discordapp.com/attachments/869191622208925709/869213951068614656/Invoice_3326809.xlsm
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Loads dropped DLL
-