Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d673e8266b78ac77053801aab832b217.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
General
-
Target
d673e8266b78ac77053801aab832b217.exe
-
Size
1.1MB
-
MD5
d673e8266b78ac77053801aab832b217
-
SHA1
5094e5909978968238dc65baed1d0698cfec8c36
-
SHA256
5788266485c0e0a04794268d9a1ba74a6cc9bef174a0a6865405249539f554a2
-
SHA512
216cb16ef08d370eba2ce2d52f657f7dff47e63d9a822733501c392332f5a3a617b90359649052b3cf98ecad7fb6834e3bfcffc8a4cbb54087ced51e7c987628
-
SSDEEP
12288:bM+ZdkmHubeaCo6Lga1w2A/sUQBJ8gvp:bMcpTo6sg+0BO0
Malware Config
Extracted
Family
dridex
Botnet
10111
C2
177.52.173.20:9043
192.100.170.1:10172
166.62.103.55:7443
rc4.plain
rc4.plain
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
d673e8266b78ac77053801aab832b217.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d673e8266b78ac77053801aab832b217.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2912-0-0x00000000002A0000-0x00000000002DC000-memory.dmpFilesize
240KB
-
memory/2912-1-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/2912-2-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/2912-6-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB