Analysis
-
max time kernel
76s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 06:22
Static task
static1
Behavioral task
behavioral1
Sample
a3964e09428462779116313ac4e1d950.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
a3964e09428462779116313ac4e1d950.exe
-
Size
981KB
-
MD5
a3964e09428462779116313ac4e1d950
-
SHA1
7dfa23ace3104920e325b5941f2ae9a86194587f
-
SHA256
f4d2673bd6c42c2d33f83ea67949b6a63fe423fd8225600ca9f163e0808b56c2
-
SHA512
38ca94adad281bf66fdbafe882c41ac706d64bc12ff80269278178b1109ce98c26ee66d9dd632c337840a3cbaae98d6c7b0c3e5d328f8800cc37fd2246048a1f
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
85.254.196.150:6225
59.21.235.107:9676
185.30.32.51:9676
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a3964e09428462779116313ac4e1d950.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a3964e09428462779116313ac4e1d950.exe