9216526157ed184c1f035f8f7b487bc6561eb4542b85531f94f60b2fe09349c7 | Triage

Submit
Reports

Overview

overview

8

Static

static

dridex

windows10-2004-x64

8

Sharing

General

Target

9216526157ed184c1f035f8f7b487bc6561eb4542b85531f94f60b2fe09349c7
Size

1.0MB
Sample

221123-md26padh24
MD5

be0a43bf4b9676686ecaaef74015bf60
SHA1

03449f9f7532f7d69890717d9e39bada9170a72b
SHA256

9216526157ed184c1f035f8f7b487bc6561eb4542b85531f94f60b2fe09349c7
SHA512

8af63dab5f4164ec8a5f946b53b4b14e1b268caaf6f5df9724add30c1dd030e9b9944794e3e3fe8bd10961b07332703fe51e3eed18b4067d0a239fae3934dd2e
SSDEEP

24576:xPFsSP/HfxreDSs/NaGCvYJq6FB7zGP0UsGgSaA:xtxP/HjyJbg6FB7zGP0H

Score

8^/10

collection discovery persistence spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

9216526157ed184c1f035f8f7b487bc6561eb4542b85531f94f60b2fe09349c7.exe

Resource

win10v2004-20220901-en

collection discovery persistence spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  9216526157ed184c1f035f8f7b487bc6561eb4542b85531f94f60b2fe09349c7
- Size
  
  1.0MB
- MD5
  
  be0a43bf4b9676686ecaaef74015bf60
- SHA1
  
  03449f9f7532f7d69890717d9e39bada9170a72b
- SHA256
  
  9216526157ed184c1f035f8f7b487bc6561eb4542b85531f94f60b2fe09349c7
- SHA512
  
  8af63dab5f4164ec8a5f946b53b4b14e1b268caaf6f5df9724add30c1dd030e9b9944794e3e3fe8bd10961b07332703fe51e3eed18b4067d0a239fae3934dd2e
- SSDEEP
  
  24576:xPFsSP/HfxreDSs/NaGCvYJq6FB7zGP0UsGgSaA:xtxP/HjyJbg6FB7zGP0H
Score

8^/10

collection discovery persistence spyware stealer
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy