Analysis
-
max time kernel
111s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
25/02/2025, 04:25
General
-
Target
868bffcef3c7af0b582a566c95f3923d304a152017a940e7079766b4fbf3223a.exe
-
Size
168KB
-
MD5
149c4d1d0e5d83771fa028a373e9936f
-
SHA1
c1549fee07ec73c2b649e9f69193420544a9e024
-
SHA256
868bffcef3c7af0b582a566c95f3923d304a152017a940e7079766b4fbf3223a
-
SHA512
413031e56f00c7a0e35e23f86e856cdf2450bc985d30147d5688ddff4a0cd712f5338ad611b5a1b772d44517ea60d727ffa7baef6ef5b39f4fc7855b562c8560
-
SSDEEP
3072:QFKzngUjWcmyJHsAFOBEUkwMiOYEIBBnr+yaES22n9QBbSj+kTNy027Aizyv4QpD:QFKsShLJHdkhLOYEIBBrda2QnTNlAATH
Malware Config
Extracted
dridex
185.14.148.34:443
62.75.159.154:884
92.222.219.26:4433
207.210.242.14:3389
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\868bffcef3c7af0b582a566c95f3923d304a152017a940e7079766b4fbf3223a.exe"C:\Users\Admin\AppData\Local\Temp\868bffcef3c7af0b582a566c95f3923d304a152017a940e7079766b4fbf3223a.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
172KB
-
Filesize
172KB