Analysis
-
max time kernel
54s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 19:43
General
-
Target
048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0.exe
-
Size
510KB
-
MD5
2ff0af0aa54f06c43c7a586a50ed7a0b
-
SHA1
e39dfac475cbc43459269f4ecb72dfb97903fb24
-
SHA256
048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0
-
SHA512
f4c9f3c99af17bc182da26e61288193d127a3f0c08b39c7d5e28d57d7f0b80b24f67ed527b69e4cc06056e2bb618a73becf2aaef8df37e993a2f629369e88bd6
-
SSDEEP
6144:jwUfyIU4F2yz2EwlwUsViffD//XiCM0pS/zzRYtJtxs5KfAnq1goVnJY0dK8/K3B:UUaIU47PCwWrpS76J7sEoODIv3waMu
Malware Config
Extracted
dridex
10111
217.20.166.177:443
54.38.143.246:691
92.38.128.47:3389
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 3 IoCs
Detects 'dmod' strings in Dridex loader.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0.exe"C:\Users\Admin\AppData\Local\Temp\048fe280a5f3a1fa3bede5c74bafa13a0f3b161fa21599568cdb53ae41d51df0.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
524KB