Analysis
-
max time kernel
110s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 09:12
General
-
Target
322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db.exe
-
Size
671KB
-
MD5
767124949dc18b6c05b58048918cfa19
-
SHA1
33e76d3ee1ae1fe2cdff0f3db5b15d670e12afa7
-
SHA256
322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db
-
SHA512
92ddadb1405d197236fbe271c3f7610416c1da4d0376a99f16a7b6d8c366910d9570830c69587cddc4fa2981b1b419b11e70799d0ca0f205d68c089da77efeb4
-
SSDEEP
12288:UYdfTGnYdfTGtsgqZXoYXMHGy1HxHFvja1E+YzVQ7aQEwhD942:UYdbyYdb6u3XMHGy1JFvuYzPSe2
Malware Config
Extracted
dridex
10111
5.9.178.143:443
37.139.2.140:3889
49.212.179.180:3889
69.64.62.4:4443
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db.exe"C:\Users\Admin\AppData\Local\Temp\322b876d63b85bc49dde46c661af1bcc72f2a343a58514aec1d097e249efa4db.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
244KB
-
Filesize
724KB
-
Filesize
244KB
-
Filesize
724KB