Resubmissions

23-12-2021 14:54

211223-r99ymaaghq 10

23-12-2021 14:00

211223-razzdaagck 1

General

  • Target

    Results12232021.xls

  • Size

    631KB

  • Sample

    211223-r99ymaaghq

  • MD5

    59212fd7cad43916cc463c7ef87d188d

  • SHA1

    4f5062437f794bab251ba87bbcc6c424c00491d8

  • SHA256

    d48e9dc2d8ce89aa5eb4a90b4eb2d60368fd7e3bdcfeb9a8a7cda9b11ac40e7e

  • SHA512

    f6830814de3cf57b5c940b6f5c03375222cf11b9b71d4e1b0a72cb88fcd87147c9ec1e9e1af0d9141a2606555152a421687a8c23a290a2a29f5cfa2581da1d6d

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

144.91.122.102:443

85.10.248.28:593

185.4.135.27:5228

80.211.3.13:8116

rc4.plain
rc4.plain

Targets

    • Target

      Results12232021.xls

    • Size

      631KB

    • MD5

      59212fd7cad43916cc463c7ef87d188d

    • SHA1

      4f5062437f794bab251ba87bbcc6c424c00491d8

    • SHA256

      d48e9dc2d8ce89aa5eb4a90b4eb2d60368fd7e3bdcfeb9a8a7cda9b11ac40e7e

    • SHA512

      f6830814de3cf57b5c940b6f5c03375222cf11b9b71d4e1b0a72cb88fcd87147c9ec1e9e1af0d9141a2606555152a421687a8c23a290a2a29f5cfa2581da1d6d

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks