Extracted

Extracted

• • Target
    Insurance Renewal.xlsm
  • Size 291KB
  • SHA256 7797c21f3ff516efe2b7b8bb00dbe9aceec4ac9b3a742763b3745b2608d5ded3
  • MD5 7f1860dddf16328a520c92afc91bdb9b
  • SHA1 deb5381de152882abe02d5b02475587ae6841350
  • SHA512 970650eef2153cab5da0f1bfb2bfd44a83b98ca18514f1d42a8f86a1cfce8730717ea2a297a12b6d3560bb8a21e3527582579d957ffc16ae83713d12a82d393a
  • MD5 SHA1 SHA512

  Score

  10^/10

  dridex22201botnetloader

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  behavioral1behavioral2