Analysis
-
max time kernel
110s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 04:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
120 seconds
General
-
Target
de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe
-
Size
164KB
-
MD5
f0fd4f975c0245d3a798bb5ec804fefd
-
SHA1
5172ba78a8a0c471a185c906c25e627d21105bcd
-
SHA256
de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1
-
SHA512
818f6794f6266384ca8fbb5b1582d771dcad5c452c09d673f6bcfd7d3d5deffa869787dc38ea2a62726c85b079856ea2e444f6b86755823dd505c9941db0b9c5
-
SSDEEP
3072:vcf+u4HhwG5A7kJUjc/8JTAf5NRj/BtWsaeEaUsFGWGLorDfxVi67zq44r:vBOGu7yf5LVtufcVDpj7zqn
Malware Config
Extracted
Family
dridex
C2
2.56.212.75:443
103.80.51.61:691
88.220.65.41:3389
185.69.154.108:691
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/1308-1-0x0000000000A20000-0x0000000000A4B000-memory.dmp dridex_ldr behavioral2/memory/1308-3-0x0000000000A20000-0x0000000000A4B000-memory.dmp dridex_ldr -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeShutdownPrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe Token: SeCreatePagefilePrivilege 1308 de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe"C:\Users\Admin\AppData\Local\Temp\de48c0ac99319fdd559550293c43a05041cccf49370442ff006abfac87ad10f1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1308