aa9b351364a17b75e893594097e0cd1f397f19f43ec85ae32156480a892896db | Triage

Submit
Reports

Overview

overview

8

Static

static

dridex

windows10-2004-x64

8

Sharing

General

Target

aa9b351364a17b75e893594097e0cd1f397f19f43ec85ae32156480a892896db
Size

1.0MB
Sample

221227-j5gsaaee52
MD5

12647c0c708103e8c39932012363a82c
SHA1

c24e05fcf0f95e5d30c101ca50b51c467d1746d4
SHA256

aa9b351364a17b75e893594097e0cd1f397f19f43ec85ae32156480a892896db
SHA512

d9dc853f5888fcdd9a6e6bd2cae0e797cbe4d45b64fbd705096246d252cc622483b30495930028ce9247bba4b847b867cef37c2f72ec62726da0377aef3207f4
SSDEEP

24576:Vjq2HQycQa59kmcpF/E3frX3PYZ/9Tbx1o1vbCTgZ8xaNPyrc:V2Krb+9bwEP7PuTbGbZZ8xcPyr

Score

8^/10

collection discovery persistence spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

aa9b351364a17b75e893594097e0cd1f397f19f43ec85ae32156480a892896db.exe

Resource

win10v2004-20221111-en

collection discovery persistence spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  aa9b351364a17b75e893594097e0cd1f397f19f43ec85ae32156480a892896db
- Size
  
  1.0MB
- MD5
  
  12647c0c708103e8c39932012363a82c
- SHA1
  
  c24e05fcf0f95e5d30c101ca50b51c467d1746d4
- SHA256
  
  aa9b351364a17b75e893594097e0cd1f397f19f43ec85ae32156480a892896db
- SHA512
  
  d9dc853f5888fcdd9a6e6bd2cae0e797cbe4d45b64fbd705096246d252cc622483b30495930028ce9247bba4b847b867cef37c2f72ec62726da0377aef3207f4
- SSDEEP
  
  24576:Vjq2HQycQa59kmcpF/E3frX3PYZ/9Tbx1o1vbCTgZ8xaNPyrc:V2Krb+9bwEP7PuTbGbZZ8xcPyr
Score

8^/10

collection discovery persistence spyware stealer
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectiondiscoverypersistencespywarestealer

© 2018-2025

Terms | Privacy