Analysis
-
max time kernel
110s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 18:02
General
-
Target
d2b1389d5b802fee8db7ef55af9189304b7fede7532b1c7c16b0e6ed373012ffN.exe
-
Size
168KB
-
MD5
57f35f004a6b9f1c35daafb07b8d0ca0
-
SHA1
dcc7257793980d69e732a2634f31aded1e867e43
-
SHA256
d2b1389d5b802fee8db7ef55af9189304b7fede7532b1c7c16b0e6ed373012ff
-
SHA512
f928f6d4565feb9f124a66dcaba97d0885a0a53a13a325fce3fafd1f979a3f9a0e3e9f0eb0df2fb4464106b740553f1e3e85b347034349c595ba26aa393b6bc0
-
SSDEEP
3072:QFKzngUjWcmyJHsAFOBEUkwMiOYEIBBnr+yaES22n9QBbSj+kTNy027Aizyv4QpW:QFKsShLJHdkhLOYEIBBrda2QnTNlAATO
Malware Config
Extracted
dridex
185.14.148.34:443
62.75.159.154:884
92.222.219.26:4433
207.210.242.14:3389
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2b1389d5b802fee8db7ef55af9189304b7fede7532b1c7c16b0e6ed373012ffN.exe"C:\Users\Admin\AppData\Local\Temp\d2b1389d5b802fee8db7ef55af9189304b7fede7532b1c7c16b0e6ed373012ffN.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
172KB
-
Filesize
172KB