67fec844374c7c14f882dc0a45ad84a25770e87842d322d26e2c8f337633910e | Triage

Submit
Reports

Overview

overview

Static

static

3

dridex

windows10-1703-x64

Sharing

General

Target

67fec844374c7c14f882dc0a45ad84a25770e87842d322d26e2c8f337633910e
Size

1.4MB
Sample

230801-hw5bjseb24
MD5

6745296ca0cabbe2820b3cd4d42a4de9
SHA1

aed0ffc6fe394d980d89433f9b46e1ead9ea1b92
SHA256

67fec844374c7c14f882dc0a45ad84a25770e87842d322d26e2c8f337633910e
SHA512

485c9a12c6ddd313084f8fd5d6f906407d96f3c57d4cf388dd559ab63cb6c1a6ac9356c452618b124080ead3155d5df1c3ec3edf4239c1cc6bb201c5fb8a5142
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

67fec844374c7c14f882dc0a45ad84a25770e87842d322d26e2c8f337633910e.exe

Resource

win10-20230703-en

evasion persistence upx

windows10-1703-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  67fec844374c7c14f882dc0a45ad84a25770e87842d322d26e2c8f337633910e
- Size
  
  1.4MB
- MD5
  
  6745296ca0cabbe2820b3cd4d42a4de9
- SHA1
  
  aed0ffc6fe394d980d89433f9b46e1ead9ea1b92
- SHA256
  
  67fec844374c7c14f882dc0a45ad84a25770e87842d322d26e2c8f337633910e
- SHA512
  
  485c9a12c6ddd313084f8fd5d6f906407d96f3c57d4cf388dd559ab63cb6c1a6ac9356c452618b124080ead3155d5df1c3ec3edf4239c1cc6bb201c5fb8a5142
- SSDEEP
  
  24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Firewall
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

© 2018-2024

Terms | Privacy