Analysis
-
max time kernel
120s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 05:56
Static task
static1
Behavioral task
behavioral1
Sample
a406e66f87860e8e4369cdfd39228c8f.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
a406e66f87860e8e4369cdfd39228c8f.exe
-
Size
481KB
-
MD5
a406e66f87860e8e4369cdfd39228c8f
-
SHA1
2653bb6e62e289de5373012a4de89595df7f26fd
-
SHA256
0a1e917be7ffa997f003bf18267e8e5c2bc986111b84dae89afb834747e86f8a
-
SHA512
99d5481ca85cdf2db8852b367658ce01f4a1ead875c1bb234bdec4e49f84598444f5ed91dcc42140bda891d394a4ba675cfcd1b3eaea624ce4318026e7f571f4
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
195.210.28.115:7443
211.172.241.52:9676
87.121.52.85:6225
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a406e66f87860e8e4369cdfd39228c8f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a406e66f87860e8e4369cdfd39228c8f.exe