dridex | befc5c44fd4c0f5a007c8b77b77f1fec7066e8d85d4cd4d735b07a943a05866a

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a23af4d5a0c2b60dbfbfd72eba784d52.exe
Size

1.1MB
MD5

a23af4d5a0c2b60dbfbfd72eba784d52
SHA1

d6ee6d33eb66bec8209282d07be76d612d33a9ff
SHA256

befc5c44fd4c0f5a007c8b77b77f1fec7066e8d85d4cd4d735b07a943a05866a
SHA512

46ef9629eebb7e12f1197182ee7ca9d16c4c3187c987c47206ff1600bff225c9e553474ac59025430f184e8570bf3b76e8b5573430b11b180d241a48d51854cf
SSDEEP

12288:LM+ZdkmHubeaCo6TRg522A/sUQBJ8Gvp:LMcpTo6a00BOq

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

176.9.89.122:10172

147.91.31.1:6225

103.30.247.115:7443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a23af4d5a0c2b60dbfbfd72eba784d52.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a23af4d5a0c2b60dbfbfd72eba784d52.exe

C:\Users\Admin\AppData\Local\Temp\a23af4d5a0c2b60dbfbfd72eba784d52.exe
"C:\Users\Admin\AppData\Local\Temp\a23af4d5a0c2b60dbfbfd72eba784d52.exe"
1⤵
- Checks whether UAC is enabled
PID:2844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab6451.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
memory/2844-1-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2844-0-0x00000000002A0000-0x00000000002DC000-memory.dmp

Filesize
240KB

Download
memory/2844-18-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2844-20-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download