4fd0be2f1b6c0873f9ec259990f8995fec3a75917c654b5cc26be526d5959741 | Triage

Submit
Reports

Overview

overview

8

Static

static

dridex

windows10-2004-x64

8

Sharing

General

Target

4fd0be2f1b6c0873f9ec259990f8995fec3a75917c654b5cc26be526d5959741
Size

1.0MB
Sample

221223-mn7txsbe4t
MD5

052b99f0511358c941e75a2556c7b5c3
SHA1

d5f01d0937486cfc293385ee168a59f6a6e37e9e
SHA256

4fd0be2f1b6c0873f9ec259990f8995fec3a75917c654b5cc26be526d5959741
SHA512

26313a66a47f27b24891e13a97e0929412e4a883a0bad61a0ad631be9704e142caed7c5ff481e4f317362941cd856d217f133ca9e66bcee67f8018b659aba404
SSDEEP

24576:mr0j+JwMtpYK0SkmLSxfznmKXDd6obXBjpIK:Q0LKVcbZDBjpIK

Score

8^/10

collection discovery persistence spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

4fd0be2f1b6c0873f9ec259990f8995fec3a75917c654b5cc26be526d5959741.exe

Resource

win10v2004-20221111-en

collection discovery persistence spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  4fd0be2f1b6c0873f9ec259990f8995fec3a75917c654b5cc26be526d5959741
- Size
  
  1.0MB
- MD5
  
  052b99f0511358c941e75a2556c7b5c3
- SHA1
  
  d5f01d0937486cfc293385ee168a59f6a6e37e9e
- SHA256
  
  4fd0be2f1b6c0873f9ec259990f8995fec3a75917c654b5cc26be526d5959741
- SHA512
  
  26313a66a47f27b24891e13a97e0929412e4a883a0bad61a0ad631be9704e142caed7c5ff481e4f317362941cd856d217f133ca9e66bcee67f8018b659aba404
- SSDEEP
  
  24576:mr0j+JwMtpYK0SkmLSxfznmKXDd6obXBjpIK:Q0LKVcbZDBjpIK
Score

8^/10

collection discovery persistence spyware stealer
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy