Overview

overview

7

Static

static

7

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 07:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    729b9c38e2230f41260beef114d0a3714da4914642f99b383e7b0c909620b664.exe

  • Size

    3.9MB

  • MD5

    286838ba958fc7761708d0400c4de2a9

  • SHA1

    3b3450b3104dc5eeefbfbcdc07f74cd56dfac08c

  • SHA256

    729b9c38e2230f41260beef114d0a3714da4914642f99b383e7b0c909620b664

  • SHA512

    dbc52c2f15d473f97f85017d790a6b8f3922d0312eba934eecea6e43e7711b225fd46c9d2f8dbe2e56e3f3f48ea9662bef1c276b4bbdb8f1377092198858124d

  • SSDEEP

    98304:xd2A2qUeyqjXCQ/5b+/r+Zhn3s76TimpFZhJFv:xd9HAqjDyUh3acpF/v

Score
7/10
aspackv2

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Loads dropped DLL 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\729b9c38e2230f41260beef114d0a3714da4914642f99b383e7b0c909620b664.exe
    "C:\Users\Admin\AppData\Local\Temp\729b9c38e2230f41260beef114d0a3714da4914642f99b383e7b0c909620b664.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\c_login_2[1].js
    Filesize

    207KB

    MD5

    63e69449172961457cfaecdca379496f

    SHA1

    ee893459570a57bdb622a553bcd764c6cf31a606

    SHA256

    76fd47eb25aa5bddf92c217e437c32165d2ef78f37c1d0816a3feea2644933fc

    SHA512

    9f6dab7bb8d1009e0cbcf2bf54a1cb26d6bd0122defcc37f300cc7ab24e312a871160b6bd9ff94351f0d5150eb43f201f8ab04cdca115bab5442f459e9fcb6ff

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\Crypto.dll
    Filesize

    361KB

    MD5

    9a253359c2434a180085fc61272e0beb

    SHA1

    495a7fdee57150ef409e3e098d817213dbd6217e

    SHA256

    fd5d8f50d0b114192cc5b5d7f411e3e0a3090518d78757d11ddc631b3198905b

    SHA512

    dd1126849b560fb3512b78fe8a6500c498a57bbe2b37802784adf517ac43f72303c629fcced49c9dd7d6e23ced400db55356708a6909f362c9ae6e459327bd82

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\HtmlView.fne
    Filesize

    212KB

    MD5

    f9a994df4d407bc79f7c84886fe7a654

    SHA1

    c93e4be70794164b7b339218cc832ac94074d08e

    SHA256

    2e9769ace867c79d5fcdda0eb2660c52b5e062c69b36add42d22eb0dddc4b3ee

    SHA512

    41b1333ed08c10aaef3d766fec2d6b2fa4c79001d7ce18a06918c2aa8c4ade69018522882bfd4543add31efbef5e7bb450511f80dc9b580eb022cb7c406a820e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\HtmlView.fne
    Filesize

    212KB

    MD5

    f9a994df4d407bc79f7c84886fe7a654

    SHA1

    c93e4be70794164b7b339218cc832ac94074d08e

    SHA256

    2e9769ace867c79d5fcdda0eb2660c52b5e062c69b36add42d22eb0dddc4b3ee

    SHA512

    41b1333ed08c10aaef3d766fec2d6b2fa4c79001d7ce18a06918c2aa8c4ade69018522882bfd4543add31efbef5e7bb450511f80dc9b580eb022cb7c406a820e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\dp1.fne
    Filesize

    128KB

    MD5

    07201b1fd5f8925dd49a4556ac3b5bab

    SHA1

    a76afbb44376912f823f2b461507c28d2585a96c

    SHA256

    abebbb0981d3d51eb63abcfa68be98da0cae4e6e3b143dd431fc845d1457dbd2

    SHA512

    0cf673ce1b6cad38f0211231e876f00f6a8397a5f3e71680046f4a216bbe0f47f4541e5f5b49364310e41a04cce14703459725c3d9f052f9da13624e73753e12

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\dp1.fne
    Filesize

    128KB

    MD5

    07201b1fd5f8925dd49a4556ac3b5bab

    SHA1

    a76afbb44376912f823f2b461507c28d2585a96c

    SHA256

    abebbb0981d3d51eb63abcfa68be98da0cae4e6e3b143dd431fc845d1457dbd2

    SHA512

    0cf673ce1b6cad38f0211231e876f00f6a8397a5f3e71680046f4a216bbe0f47f4541e5f5b49364310e41a04cce14703459725c3d9f052f9da13624e73753e12

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\eAPI.fne
    Filesize

    308KB

    MD5

    7c1ff88991f5eafab82b1beaefc33a42

    SHA1

    5ea338434c4c070aaf4e4e3952b4b08b551267bc

    SHA256

    53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731

    SHA512

    310c90c82b545160420375c940b4d6176400e977f74048bfe2e0d0784bc167b361dc7aac149b8379f6e24050a253f321a6606295414ea9b68a563d59d0d17a48

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\eAPI.fne
    Filesize

    308KB

    MD5

    7c1ff88991f5eafab82b1beaefc33a42

    SHA1

    5ea338434c4c070aaf4e4e3952b4b08b551267bc

    SHA256

    53483523c316ad8c022c2b07a5cabfff3339bc5cb5e4ac24c3260eea4f4d9731

    SHA512

    310c90c82b545160420375c940b4d6176400e977f74048bfe2e0d0784bc167b361dc7aac149b8379f6e24050a253f321a6606295414ea9b68a563d59d0d17a48

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext.fnr
    Filesize

    204KB

    MD5

    856495a1605bfc7f62086d482b502c6f

    SHA1

    86ecc67a784bc69157d664850d489aab64f5f912

    SHA256

    8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf

    SHA512

    35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext.fnr
    Filesize

    204KB

    MD5

    856495a1605bfc7f62086d482b502c6f

    SHA1

    86ecc67a784bc69157d664850d489aab64f5f912

    SHA256

    8c8254cb49f7287b97c7f952c81edabc9f11f3fa3f02f265e67d5741998cf0bf

    SHA512

    35a6e580cd362c64f1e1f9c3439660bd980ec437bd8cabbdc49479ceb833cd8cb6c82d2fb747516d5cfcf2af0ba540bc01640171fbe3b4d0e0a3eeeaa69dd1d9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext2.fne
    Filesize

    492KB

    MD5

    dba5fdbe7ec94463b3f6fdf2162c9f95

    SHA1

    a97137b4f2b77166b2a23da1f58e0bdb7365f4f2

    SHA256

    a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37

    SHA512

    325439bb5fe0e18e08cd547e9e9d505aa5b1ee51a436cb155254cfb04d318679e7a016cc2e72ffaba49bed20e15e85b26fd2a22e726e211650317218dde53ba6

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext2.fne
    Filesize

    492KB

    MD5

    dba5fdbe7ec94463b3f6fdf2162c9f95

    SHA1

    a97137b4f2b77166b2a23da1f58e0bdb7365f4f2

    SHA256

    a8b14f31098a191631696db5ddc77e029b48999542e0ec15b63df02220c66d37

    SHA512

    325439bb5fe0e18e08cd547e9e9d505aa5b1ee51a436cb155254cfb04d318679e7a016cc2e72ffaba49bed20e15e85b26fd2a22e726e211650317218dde53ba6

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext3.fne
    Filesize

    384KB

    MD5

    d2a9c02acb735872261d2abc6aff7e45

    SHA1

    fce6c2cf2465856168ea55ccd806155199a6f181

    SHA256

    0216a0f6d6d5360ab487e696b26a39eb81a1e2c8cd7f59c054c90ab99a858daf

    SHA512

    c29a0669630ddf217d0a0dcd88272d1ec05b6e5cd7ab2eb9379bdc16efbc40a6c17cfd8a5dba21ce07060d54a2a3d8944aaa36a3b92e8025112a751d264a897d

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext3.fne
    Filesize

    384KB

    MD5

    d2a9c02acb735872261d2abc6aff7e45

    SHA1

    fce6c2cf2465856168ea55ccd806155199a6f181

    SHA256

    0216a0f6d6d5360ab487e696b26a39eb81a1e2c8cd7f59c054c90ab99a858daf

    SHA512

    c29a0669630ddf217d0a0dcd88272d1ec05b6e5cd7ab2eb9379bdc16efbc40a6c17cfd8a5dba21ce07060d54a2a3d8944aaa36a3b92e8025112a751d264a897d

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext6.fne
    Filesize

    232KB

    MD5

    4f28d54f86a2a65476c1fd404d766757

    SHA1

    8dfaa7f2f5e0b74c66cc72817a73b584f6cd5ab3

    SHA256

    fdd8b6fe63316d94fac544356dd3237c376c79ed6011b2032aa926a92e5b6dd9

    SHA512

    e5857e8f5bf97a40d479e6528af1fa0c05f2a0794e19cf97b84786d037e78ff9ac3e05ffcc89b8fee85757dd3cff474215a1cdca81799f271908654312abcbe4

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\iext6.fne
    Filesize

    232KB

    MD5

    4f28d54f86a2a65476c1fd404d766757

    SHA1

    8dfaa7f2f5e0b74c66cc72817a73b584f6cd5ab3

    SHA256

    fdd8b6fe63316d94fac544356dd3237c376c79ed6011b2032aa926a92e5b6dd9

    SHA512

    e5857e8f5bf97a40d479e6528af1fa0c05f2a0794e19cf97b84786d037e78ff9ac3e05ffcc89b8fee85757dd3cff474215a1cdca81799f271908654312abcbe4

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\internet.fne
    Filesize

    188KB

    MD5

    7b129c5916896c845752f93b9635fc4c

    SHA1

    e3fc632af5e1f36e8022e651f64eb8f8381c73c3

    SHA256

    adc45970f4a0eafd2f372302f64836802380c253096a99ca964677a70a7128f8

    SHA512

    c72dd4043e7cdc0ccefe26ce8a6d05701b4c610f88ab827e6731296da76b8cbe5b63c0970954ec7616369172b8b8f9cb546545271be3e86c18c54d0b9cad8f95

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\internet.fne
    Filesize

    188KB

    MD5

    7b129c5916896c845752f93b9635fc4c

    SHA1

    e3fc632af5e1f36e8022e651f64eb8f8381c73c3

    SHA256

    adc45970f4a0eafd2f372302f64836802380c253096a99ca964677a70a7128f8

    SHA512

    c72dd4043e7cdc0ccefe26ce8a6d05701b4c610f88ab827e6731296da76b8cbe5b63c0970954ec7616369172b8b8f9cb546545271be3e86c18c54d0b9cad8f95

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\krnln.fnr
    Filesize

    1.2MB

    MD5

    142aeebfe85bde2a411116e39d8fd505

    SHA1

    d42b401d32a7141e592096bb68b6e029a1b13eae

    SHA256

    c77a0f67c3392dee0fb04f0544d8fd8a3b6ef072d371303afd3a2c468dda7a35

    SHA512

    afd98e398bfca447bf7df3c4899a30cbef981402283989c6b03956f4d51561410bd6fc319ee900a17ca5842f3ef9102d9b4bc3635082fd2978d57137202b27ba

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\spec.fne
    Filesize

    72KB

    MD5

    bd6eef5ea9a52a412a8f57490d8bd8e4

    SHA1

    ab61ad7f66c5f6dfb8d28eba1833591469951870

    SHA256

    0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0

    SHA512

    1c43e50270eed071c8ef35e1c4695a93b9f98e668d4aebb44eb3b620efd2624b381554d2daf2d017f764b485e060abd589216043adea19eac94028ce66cc2025

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\spec.fne
    Filesize

    72KB

    MD5

    bd6eef5ea9a52a412a8f57490d8bd8e4

    SHA1

    ab61ad7f66c5f6dfb8d28eba1833591469951870

    SHA256

    0c9e6eb8648f4bf5c585d5344035e91c3249bb9686a302503b4681b7ba828dc0

    SHA512

    1c43e50270eed071c8ef35e1c4695a93b9f98e668d4aebb44eb3b620efd2624b381554d2daf2d017f764b485e060abd589216043adea19eac94028ce66cc2025

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\xplib.fne
    Filesize

    80KB

    MD5

    8f385e7c8cf1f8ebdae0448473977cc7

    SHA1

    942bf465e29a5e5f85580eb30aa9510b92f802d7

    SHA256

    d1a1c6bac6a498adccdafab9d600a372aa9d5b826a33cfa06aaa9f75357c5b23

    SHA512

    2372a8857591b829763cacbdfc0cf3d4884598c5f1c43f0815257cb7fb3b2c93b60b1027480e1d5a93bbc6eba054328d8d2b4997c7d81a5360811f8f1eecafa1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\E_N60005\xplib.fne
    Filesize

    80KB

    MD5

    8f385e7c8cf1f8ebdae0448473977cc7

    SHA1

    942bf465e29a5e5f85580eb30aa9510b92f802d7

    SHA256

    d1a1c6bac6a498adccdafab9d600a372aa9d5b826a33cfa06aaa9f75357c5b23

    SHA512

    2372a8857591b829763cacbdfc0cf3d4884598c5f1c43f0815257cb7fb3b2c93b60b1027480e1d5a93bbc6eba054328d8d2b4997c7d81a5360811f8f1eecafa1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\config.pck
    Filesize

    4.2MB

    MD5

    77547ebb89f6924f0a52b26a63e2d328

    SHA1

    ae3e3c4d734635ec645abbc118bc39ef10d151d6

    SHA256

    c611b6cfe82c4dc2f0c46a976e61990ffde108d62821284e7dbdf06a79f67e0c

    SHA512

    4d0e2e4a6fa16345bd1d142b2c43d7d332966dc07ddaa419b135c951395eff9fb0c6614a2b111bdecd99a99f89f4ac61bc402d895a42f56520a454e720e8511e

    Download Submit
  • memory/4648-217-0x00000000031E0000-0x000000000326B000-memory.dmp
    Filesize

    556KB

    Download
  • memory/4648-224-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-202-0x00000000046F0000-0x000000000471E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/4648-133-0x0000000000400000-0x00000000005A8000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/4648-211-0x00000000031B0000-0x00000000031C4000-memory.dmp
    Filesize

    80KB

    Download
  • memory/4648-182-0x0000000003750000-0x00000000037AD000-memory.dmp
    Filesize

    372KB

    Download
  • memory/4648-175-0x0000000003040000-0x0000000003089000-memory.dmp
    Filesize

    292KB

    Download
  • memory/4648-168-0x0000000002D40000-0x0000000002DAF000-memory.dmp
    Filesize

    444KB

    Download
  • memory/4648-161-0x0000000002800000-0x0000000002841000-memory.dmp
    Filesize

    260KB

    Download
  • memory/4648-225-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-226-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-205-0x0000000000400000-0x00000000005A8000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/4648-230-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-195-0x00000000038D0000-0x000000000390E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/4648-240-0x00000000027C0000-0x00000000027F8000-memory.dmp
    Filesize

    224KB

    Download
  • memory/4648-155-0x0000000000400000-0x00000000005A8000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/4648-189-0x00000000038B0000-0x00000000038C7000-memory.dmp
    Filesize

    92KB

    Download
  • memory/4648-279-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-134-0x0000000000400000-0x00000000005A8000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/4648-308-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-312-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download
  • memory/4648-327-0x00000000742A0000-0x0000000074398000-memory.dmp
    Filesize

    992KB

    Download