Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-08-2021 13:31
Static task
static1
Behavioral task
behavioral1
Sample
a1854382172275a7816869278a64178a.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
a1854382172275a7816869278a64178a.exe
-
Size
1.1MB
-
MD5
a1854382172275a7816869278a64178a
-
SHA1
40c8c4e16848e73593359cdb85e93179e1a35cf1
-
SHA256
43ef2ed6c4ee2e7bdc2d73dcaa282ab908f8021636c47a0b8be83b6a135029f6
-
SHA512
26054e22ec79f89763f84399f9e8513669dc46d05114bbe7d49f052d419784c77cfae306564680c51a46d854bb72a23a91246d04c9e04d190ac5b1cc61f7b5f0
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
139.59.124.65:6225
138.121.91.136:9043
103.253.107.155:7443
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a1854382172275a7816869278a64178a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1854382172275a7816869278a64178a.exe