Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    27-08-2021 09:42

General

  • Target

    523889c41d9c65281f118d3f4c26c708.exe

  • Size

    1.8MB

  • MD5

    523889c41d9c65281f118d3f4c26c708

  • SHA1

    f33305576a93f1d66896bd2a1a3b0d3eb85d9a40

  • SHA256

    0ccc1ea2dc07c5d01ffbcdf63a94f5bf52fac32ab3d9075204cd07b2d0455126

  • SHA512

    20e5da18708129645ef053b392d50cf8e30781441c402870d3aad9cb9a6b72ea471d39d5fa4c905fef15f1a95bfc37b458ace6ec63305ab10b7b8a9b5dcd246e

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

5.135.167.231:8443

212.53.160.143:10172

51.75.162.188:6225

rc4.plain
rc4.plain

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\523889c41d9c65281f118d3f4c26c708.exe
    "C:\Users\Admin\AppData\Local\Temp\523889c41d9c65281f118d3f4c26c708.exe"
    1⤵
    • Checks whether UAC is enabled
    PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/940-60-0x0000000075051000-0x0000000075053000-memory.dmp
    Filesize

    8KB

  • memory/940-61-0x00000000001B0000-0x00000000001EC000-memory.dmp
    Filesize

    240KB

  • memory/940-62-0x0000000000400000-0x00000000005DA000-memory.dmp
    Filesize

    1.9MB