Overview

overview

10

Static

static

dridex

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    07-08-2021 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

  • Size

    140KB

  • MD5

    711486a19e8b011528dee34a5d25776e

  • SHA1

    7e131940fce4d157d0a338b8285e8e2298e8677d

  • SHA256

    880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c

  • SHA512

    9213dc1b1ab70e6672e6bef43a50125e7752de303ddbdbfc5b395f3b228363dd57c036befb21c83945207954575b90021af0d4e1f6872253c20475f3dbc4e894

Score
10/10
evasionpersistenceransomware

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Disables Task Manager via registry modification
    evasion
  • Drops desktop.ini file(s) 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
    "C:\Users\Admin\AppData\Local\Temp\880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3692-114-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3692-117-0x00000000008B4000-0x00000000008B5000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3692-116-0x00000000008B0000-0x00000000008B2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3692-118-0x00000000008B2000-0x00000000008B4000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3692-119-0x00000000008B5000-0x00000000008B7000-memory.dmp

    Filesize

    8KB

    Download