Overview

overview

10

Static

static

Results12232021.xls

windows7_x64

10

Results12232021.xls

windows10_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Results12232021.xls

  • Size

    649KB

  • Sample

    211224-beek8scaa9

  • MD5

    9743defc7fa9a3c68e74e9ef3ce64d76

  • SHA1

    5e2c9a057ff559e623ed2746ef4f76695af96a20

  • SHA256

    df7a99e770202105350874b211c5842acbc6bf7d83b43d0f4f288172890e40cd

  • SHA512

    c2495831bd5ff5d2e147478d642e1851e038c71b0abcaf8eb0d0f6869ac6e811700a3dc340bb852562e14911602564b587378e492ad786b14409ecb7ea4e2ab9

Score
10/10
dridex22201botnetloader

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

144.91.122.102:443

85.10.248.28:593

185.4.135.27:5228

80.211.3.13:8116
rc4.plain
rc4.plain

Targets

    • Target

      Results12232021.xls

    • Size

      649KB

    • MD5

      9743defc7fa9a3c68e74e9ef3ce64d76

    • SHA1

      5e2c9a057ff559e623ed2746ef4f76695af96a20

    • SHA256

      df7a99e770202105350874b211c5842acbc6bf7d83b43d0f4f288172890e40cd

    • SHA512

      c2495831bd5ff5d2e147478d642e1851e038c71b0abcaf8eb0d0f6869ac6e811700a3dc340bb852562e14911602564b587378e492ad786b14409ecb7ea4e2ab9

    Score
    10/10
    dridex22201botnetloader

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks