Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-09-2021 15:07
Behavioral task
behavioral1
Sample
a21a285ce9482d0a0a45f4f33063c608.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
a21a285ce9482d0a0a45f4f33063c608.exe
-
Size
899KB
-
MD5
a21a285ce9482d0a0a45f4f33063c608
-
SHA1
8d519eb98ddda64f7733a3251d1d14d13dde54eb
-
SHA256
47ce31756f024d900bc4dbfb7c7c3c5ff6ef1ae93e99a7ec1e2467253297cefb
-
SHA512
f86fd14087d9d65a94082f025f48ea75ad8595487b7265a1ac9b3e43eeffae0a21015fcc682d4c5693aec8f7e6f5653f3802f98daf6406174cfe747ec6cabaff
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
159.65.3.147:6225
194.141.47.9:7443
5.199.174.90:9043
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a21a285ce9482d0a0a45f4f33063c608.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a21a285ce9482d0a0a45f4f33063c608.exe