Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10a3e2673f296e7c92fc0f7df5120390a0d25081c95d919fa8b5d5bbf7e6c4f1

  • Size

    4.8MB

  • Sample

    230714-hccr7adc6w

  • MD5

    0803c89d362fe0febe13bd092ef98ed1

  • SHA1

    036ec692eaffb018e360fd201000cfb4d9c89790

  • SHA256

    10a3e2673f296e7c92fc0f7df5120390a0d25081c95d919fa8b5d5bbf7e6c4f1

  • SHA512

    6d3cb36af5d2494ae288ed430c742372ef12ad7042b3cd7dacfe8ba839d9c342148d94129f5a3a5a1c59fbfb083cec413f9f68fb245b9d50e85d0769a87b1919

  • SSDEEP

    98304:yM8J+8omYJANECGB4s1ttmyUyASGifO7B1cbgarT7rxEXG8B5X/:gJvYmHe4s1ayUSNfOXGHnqGe1/

Score
10/10
amadeysectopratsystembcpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

3.85

C2

45.9.74.164/b7djSDcPcZ/index.php

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

    • Target

      10a3e2673f296e7c92fc0f7df5120390a0d25081c95d919fa8b5d5bbf7e6c4f1

    • Size

      4.8MB

    • MD5

      0803c89d362fe0febe13bd092ef98ed1

    • SHA1

      036ec692eaffb018e360fd201000cfb4d9c89790

    • SHA256

      10a3e2673f296e7c92fc0f7df5120390a0d25081c95d919fa8b5d5bbf7e6c4f1

    • SHA512

      6d3cb36af5d2494ae288ed430c742372ef12ad7042b3cd7dacfe8ba839d9c342148d94129f5a3a5a1c59fbfb083cec413f9f68fb245b9d50e85d0769a87b1919

    • SSDEEP

      98304:yM8J+8omYJANECGB4s1ttmyUyASGifO7B1cbgarT7rxEXG8B5X/:gJvYmHe4s1ayUSNfOXGHnqGe1/

    Score
    10/10
    amadeysectopratsystembcpersistenceratspywarestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • SectopRAT payload

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks