Analysis
-
max time kernel
13s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-08-2021 05:01
Behavioral task
behavioral1
Sample
a2c869a9287b07e8601a847b681d6080.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
a2c869a9287b07e8601a847b681d6080.exe
-
Size
650KB
-
MD5
a2c869a9287b07e8601a847b681d6080
-
SHA1
ebe0973e63917232f8608839f295c32cb209f817
-
SHA256
6878b5e139b743a2a6c9cc23c3837d4e935cdf8d4283a33c56358b9408c6960a
-
SHA512
e7ad2089ff2dd59729ed31d5299e5789cd06e32452c74e6730b76ed3a6c6e61299d0f03d675b8fe1f94b978854addb19bbdc5244faf459869a4a6acc95612e36
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
192.99.150.39:7443
46.101.182.168:10172
216.120.236.127:9043
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a2c869a9287b07e8601a847b681d6080.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a2c869a9287b07e8601a847b681d6080.exe