General

  • Target

    a5eb3426e582795b6393a328cd27bf94.exe

  • Size

    653KB

  • Sample

    211231-kr6pxsggc3

  • MD5

    a5eb3426e582795b6393a328cd27bf94

  • SHA1

    a2494b972f175cadc7e3b43d67af4c7f7efebb19

  • SHA256

    67dd305f6e4cdfaa395ca06f30d971b8a0d4bf3926bfb140b258f0704b31f92b

  • SHA512

    39ede402f550cd8fbea9c54ded315cb7a3f79bdec7807b71e285068dee125e702b9af4f1877e3bd0b8bdcabb632d2abe0057f8632d1565e0f6cdee48f4a7cfac

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

103.9.36.172:443

103.70.29.126:593

46.101.175.170:10172

rc4.plain
rc4.plain

Targets

    • Target

      a5eb3426e582795b6393a328cd27bf94.exe

    • Size

      653KB

    • MD5

      a5eb3426e582795b6393a328cd27bf94

    • SHA1

      a2494b972f175cadc7e3b43d67af4c7f7efebb19

    • SHA256

      67dd305f6e4cdfaa395ca06f30d971b8a0d4bf3926bfb140b258f0704b31f92b

    • SHA512

      39ede402f550cd8fbea9c54ded315cb7a3f79bdec7807b71e285068dee125e702b9af4f1877e3bd0b8bdcabb632d2abe0057f8632d1565e0f6cdee48f4a7cfac

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks