Overview

overview

10

Static

static

aafaeb157b...d2.exe

windows7_x64

10

aafaeb157b...d2.exe

windows10_x64

10

Analysis

  • max time kernel
    16s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    20/08/2021, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    aafaeb157be3e6f9250b324d55acfed2.exe
  • Size 715KB
  • Sample210820-m3c6csf9ka
  • SHA256 53ce752aa18d36320fc8a1c0fa6993dc866416bccc613a4fef80f2427d224824
  • MD5 SHA1 SHA512
Score
10/10
dridex10111botnetdiscoveryevasiontrojan

Malware Config

Extracted

Family

  • dridex

Botnet

  • 10111

C2

  • 50.116.62.25:8194

  • 144.76.85.240:9043

  • 185.143.48.16:7443

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\aafaeb157be3e6f9250b324d55acfed2.exe
    "C:\Users\Admin\AppData\Local\Temp\aafaeb157be3e6f9250b324d55acfed2.exe"
    1⤵
    • Checks whether UAC is enabled
    PID:856

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/856-114-0x0000000000520000-0x00000000005CE000-memory.dmp
        Download

        memory/856-115-0x0000000000400000-0x00000000004B7000-memory.dmp
        Download