Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-08-2021 07:46
Behavioral task
behavioral1
Sample
523889c41d9c65281f118d3f4c26c708.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
523889c41d9c65281f118d3f4c26c708.exe
-
Size
1.8MB
-
MD5
523889c41d9c65281f118d3f4c26c708
-
SHA1
f33305576a93f1d66896bd2a1a3b0d3eb85d9a40
-
SHA256
0ccc1ea2dc07c5d01ffbcdf63a94f5bf52fac32ab3d9075204cd07b2d0455126
-
SHA512
20e5da18708129645ef053b392d50cf8e30781441c402870d3aad9cb9a6b72ea471d39d5fa4c905fef15f1a95bfc37b458ace6ec63305ab10b7b8a9b5dcd246e
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
5.135.167.231:8443
212.53.160.143:10172
51.75.162.188:6225
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
523889c41d9c65281f118d3f4c26c708.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 523889c41d9c65281f118d3f4c26c708.exe