Analysis
-
max time kernel
57s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
02-02-2025 06:30
General
-
Target
dc2d440c9ecce953abaf1f2d4b90e3b17aed213fea4313c718c341567fb1c0e7N.exe
-
Size
787KB
-
MD5
545375df31d96329f9839c975ed57660
-
SHA1
6be4ea38e1d9f21feaa85fc6a50e7719093e9c43
-
SHA256
dc2d440c9ecce953abaf1f2d4b90e3b17aed213fea4313c718c341567fb1c0e7
-
SHA512
9829668d6cb9ac7efe21222dbe4c7491890e9286824f8b27da85f1d2d7fb820357f8656cef3345e2624e0971e32defec95baef5d16cd3322a052ccd448ab7af9
-
SSDEEP
6144:dmmO19e3qlOslMkn0an0D/jwsi5iC3Aip5ui8eYRKM1+ZpvpQKv+fFLXF2py4n0G:ENLPHLiHipGoM1D2+fBybnf
Malware Config
Extracted
dridex
10111
217.20.166.177:443
54.38.143.246:691
92.38.128.47:3389
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 3 IoCs
Detects 'dmod' strings in Dridex loader.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc2d440c9ecce953abaf1f2d4b90e3b17aed213fea4313c718c341567fb1c0e7N.exe"C:\Users\Admin\AppData\Local\Temp\dc2d440c9ecce953abaf1f2d4b90e3b17aed213fea4313c718c341567fb1c0e7N.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
-
Filesize
176KB
-
Filesize
800KB
-
Filesize
176KB