Analysis
-
max time kernel
4294210s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
19-03-2022 08:32
Static task
static1
Behavioral task
behavioral1
Sample
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
-
Target
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe
-
Size
636KB
-
MD5
783be6458fd27d5ee223d3b9e4c4b9b1
-
SHA1
0e8b1bc64e8d2d78b2fa7125e5e74f1fe660b418
-
SHA256
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834
-
SHA512
bf1c755f31b9a512b6aa171e9e62ab744ab131edd7166ddc5268231e45076a9fd4831fb2a68696da7961f16b13e4df6daa39fc8d43cb9cc27d32888ec5952d6c
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
212.129.24.83:3889
195.159.28.230:4443
208.71.173.207:3098
162.144.127.197:3786
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exepid process 580 cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe"C:\Users\Admin\AppData\Local\Temp\cdf6c29699d8d3ffb040ec131c45e0b63cf8f5c8fe0b8740c34ffb115abb7834.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam