Analysis
-
max time kernel
101s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-02-2025 14:26
General
-
Target
0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9.exe
-
Size
787KB
-
MD5
0b52525faa9bde4bbf60ac20b5220e03
-
SHA1
611e5fbffcd7c1856fe7d9133ad6c50b5c3c56e2
-
SHA256
0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9
-
SHA512
02f4d4d987c51935468acaacefc01fd79fbecba4f341d4ebaa6157af3b1f151e979f4f423c3e10fa86063511e1deb8735bebeb33d759dc457b7e8a180a3c2cb6
-
SSDEEP
6144:dmmO19e3qlOslMkn0an0D/jwsi5iC3Aip5ui8eYRKM1+ZpvpQKv+fFLXF2py4n0G:ENLPHLiHipGoM1D2+fBybn/
Malware Config
Extracted
dridex
10111
217.20.166.177:443
54.38.143.246:691
92.38.128.47:3389
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 3 IoCs
Detects 'dmod' strings in Dridex loader.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9.exe"C:\Users\Admin\AppData\Local\Temp\0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
-
Filesize
176KB
-
Filesize
800KB
-
Filesize
176KB