Analysis
-
max time kernel
16s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-08-2021 13:35
Static task
static1
Behavioral task
behavioral1
Sample
02a11d9064676f2c968292550065e9b9106ca08dcc9d68c575670d6db534a992.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
02a11d9064676f2c968292550065e9b9106ca08dcc9d68c575670d6db534a992.exe
-
Size
1.1MB
-
MD5
b478adf3d86b9806099b757400217121
-
SHA1
c4ddf46c4fa1961f52adfec7dc750ecaf284df07
-
SHA256
02a11d9064676f2c968292550065e9b9106ca08dcc9d68c575670d6db534a992
-
SHA512
f4ded284c2c37344147eb6cd85f268d195b80027705a559d565dc6e307ef297dc1d698a0dbffe24dfd55bcbfef68432f662ae6394e64defd178484c8c6308e66
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
103.109.247.13:10443
116.203.25.236:8443
103.253.107.156:7443
rc4.plain
rc4.plain
Signatures
-
Dridex v4 dropper C2 parsing function 1 IoCs
Processes:
resource yara_rule behavioral2/memory/568-115-0x0000000000400000-0x0000000000518000-memory.dmp DridexLoader -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
02a11d9064676f2c968292550065e9b9106ca08dcc9d68c575670d6db534a992.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 02a11d9064676f2c968292550065e9b9106ca08dcc9d68c575670d6db534a992.exe