Analysis
-
max time kernel
106s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 16:35
Behavioral task
behavioral1
Sample
3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9.exe
-
Size
365KB
-
MD5
d0035466f1e16bb5c3a26fc041c5978e
-
SHA1
1407ad134cc4c151b8193410785acc324fd11fba
-
SHA256
3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9
-
SHA512
dfc57ee1fdbd84c26343a0ebd04dd8fda91c3b5b2265371c0ee03923205f309dab2054f0a60e9bfc71a53ab4624724207e59d84c30409ac1e043630703ba7255
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
194.150.118.7:443
49.212.179.180:3889
69.64.62.4:4443
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9.exe