Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
24/01/2024, 02:12
General
- Target 712b82a22dca315bc0b19f33baed894c.exe
- Size 731KB
- Sample240124-cm4e1afggm
- SHA256 436c19c528a71225adcee3275fce2704617c6035c34303b6265e14297c8a3aec
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
10111
C2
-
172.104.58.76:6225
-
204.174.223.210:9043
-
51.91.105.97:8443
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\712b82a22dca315bc0b19f33baed894c.exe"C:\Users\Admin\AppData\Local\Temp\712b82a22dca315bc0b19f33baed894c.exe"1⤵
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3668-1-0x0000000000400000-0x00000000004BB000-memory.dmp
memory/3668-0-0x0000000002210000-0x000000000224C000-memory.dmp
memory/3668-2-0x0000000000400000-0x00000000004BB000-memory.dmp
memory/3668-4-0x0000000000400000-0x00000000004BB000-memory.dmp