Analysis
- max time kernel
127s - max time network
129s - platform
windows7_x64 - resource
win7v20210410 - submitted
01/08/2021, 06:45
General
- Target 870d4a5e6be7fd07f7f651544d2d8bc1.exe
- Size 1.1MB
- Sample210801-ml3btt2t4j
- SHA256 9a49377425cd34e622494bf90d1726520d879b2f7de449a65b88fa4f75965bdc
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
10111
C2
-
103.109.247.13:10443
-
116.203.25.236:8443
-
103.253.107.156:7443
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\870d4a5e6be7fd07f7f651544d2d8bc1.exe"C:\Users\Admin\AppData\Local\Temp\870d4a5e6be7fd07f7f651544d2d8bc1.exe"1⤵
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1096-60-0x00000000768B1000-0x00000000768B3000-memory.dmp
memory/1096-62-0x0000000000400000-0x0000000000518000-memory.dmp
memory/1096-61-0x0000000000230000-0x000000000026C000-memory.dmp