Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 16:41
Behavioral task
behavioral1
Sample
08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b.exe
Resource
win7-20240903-en
General
-
Target
08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b.exe
-
Size
1.1MB
-
MD5
5995924f08d3858ec7b2b3c971560a05
-
SHA1
739470e42488ec3869bff32dde282b149e131e1d
-
SHA256
08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b
-
SHA512
dc0472ff4478f784ed80db6f6a1a889dd27c3f1940a8d25fed93d4f74ec6638b8d021a52fdde7878abe023feb2b7c843be141a761616dcda1d2db02f357edbdf
-
SSDEEP
3072:FbW15JigWq7Y+jbkGenScL1FsrKY/gnl4PNN0Bi3434YFOmOXoHOZNxjRIpvWMHs:FWqqel7oe4nmOXouZqsXJa5Ga
Malware Config
Extracted
dridex
10111
162.241.44.26:9443
185.184.25.234:4664
138.201.138.91:3389
Signatures
-
Dridex family
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b.exe"C:\Users\Admin\AppData\Local\Temp\08bfde97ab8bf092da8dc7ec4b60029df60912468643aab269b1a4fc193fd13b.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:548