Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-08-2021 07:46

General

  • Target

    523889c41d9c65281f118d3f4c26c708.exe

  • Size

    1.8MB

  • MD5

    523889c41d9c65281f118d3f4c26c708

  • SHA1

    f33305576a93f1d66896bd2a1a3b0d3eb85d9a40

  • SHA256

    0ccc1ea2dc07c5d01ffbcdf63a94f5bf52fac32ab3d9075204cd07b2d0455126

  • SHA512

    20e5da18708129645ef053b392d50cf8e30781441c402870d3aad9cb9a6b72ea471d39d5fa4c905fef15f1a95bfc37b458ace6ec63305ab10b7b8a9b5dcd246e

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

5.135.167.231:8443

212.53.160.143:10172

51.75.162.188:6225

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\523889c41d9c65281f118d3f4c26c708.exe
    "C:\Users\Admin\AppData\Local\Temp\523889c41d9c65281f118d3f4c26c708.exe"
    1⤵
    • Checks whether UAC is enabled
    PID:4012

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4012-114-0x0000000000640000-0x000000000067C000-memory.dmp
    Filesize

    240KB

  • memory/4012-115-0x0000000000400000-0x00000000005DA000-memory.dmp
    Filesize

    1.9MB