Analysis
-
max time kernel
121s -
max time network
125s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
aa7a1361feb49bdc9ae17efcd3510674.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
aa7a1361feb49bdc9ae17efcd3510674.exe
-
Size
477KB
-
MD5
aa7a1361feb49bdc9ae17efcd3510674
-
SHA1
0132676344d5f38b24a57517db95bb0034abf916
-
SHA256
b454160369a30dde38ca7df6193d2d459b29ff01f601aa86cb16dcb30f1e4e9d
-
SHA512
046173ffa27d29e5cc83d836ce5778c179e539642ae947443b965b0d4c4246c90e287618ea2b338fd7c1be5040ed733ac6f3cbb106b5fdff0d3ed78c7881de3a
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
54.37.202.209:8194
144.76.162.241:10172
94.23.24.82:6225
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
aa7a1361feb49bdc9ae17efcd3510674.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aa7a1361feb49bdc9ae17efcd3510674.exe