62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22 | Triage

Submit
Reports

Overview

overview

8

Static

static

dridex

windows10-2004-x64

8

Sharing

General

Target

62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22
Size

1.1MB
Sample

221222-af3tsagg7v
MD5

9ab4a7fd7c64f150813c87cff907699d
SHA1

861b166e242fddad72973365c6ca0d242e478e5b
SHA256

62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22
SHA512

bf9e75a71bcdfcf8834ddb4dc410bfec006b1770b59aa2543adb80742c66d780eab9453a37c7bf111af6fe688d473dcd84ddbbe28376a53d3d7108affcfb7098
SSDEEP

24576:diQiGP3wIrpRPHaT72KocBZtPYDd8HunSyj:diePxBanoc5Wy+

Score

8^/10

collection discovery persistence spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe

Resource

win10v2004-20221111-en

collection discovery persistence spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22
- Size
  
  1.1MB
- MD5
  
  9ab4a7fd7c64f150813c87cff907699d
- SHA1
  
  861b166e242fddad72973365c6ca0d242e478e5b
- SHA256
  
  62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22
- SHA512
  
  bf9e75a71bcdfcf8834ddb4dc410bfec006b1770b59aa2543adb80742c66d780eab9453a37c7bf111af6fe688d473dcd84ddbbe28376a53d3d7108affcfb7098
- SSDEEP
  
  24576:diQiGP3wIrpRPHaT72KocBZtPYDd8HunSyj:diePxBanoc5Wy+
Score

8^/10

collection discovery persistence spyware stealer
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoverypersistencespywarestealer

© 2018-2025

Terms | Privacy