Analysis
-
max time kernel
12s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-08-2021 19:03
Static task
static1
Behavioral task
behavioral1
Sample
aa35fe5f1165374e495c4cfc9f40d665.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
aa35fe5f1165374e495c4cfc9f40d665.exe
-
Size
1.1MB
-
MD5
aa35fe5f1165374e495c4cfc9f40d665
-
SHA1
59acd761c7dd7c31c751331c4dd6a2d074dee311
-
SHA256
89b3261aeda0d7f5cfac096c7e899460c850e7135edee9550e6fcc38b8eaceff
-
SHA512
7e5820c80c48827947a11c72de1bcff6d757f4efd6d3ce46687071a544441d60546ec70f91b22bf2835b405fa193f67f215e35bab166ef435f3b382ff4a045b5
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
158.106.98.110:6225
149.210.181.82:10172
178.33.13.40:7443
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
aa35fe5f1165374e495c4cfc9f40d665.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aa35fe5f1165374e495c4cfc9f40d665.exe