MALICIOUS — 76d312d640f74edf963d950003541478183caf5ad6f73809bfa06e25ad04da2e
MALICIOUS — 76d312d640f74edf963d950003541478183caf5ad6f73809bfa06e25ad04da2e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Dridex family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
76d312d640f74edf963d950003541478183caf5ad6f73809bfa06e25ad04da2e - SHA-1:
270eb6cc5947caee7f3d85196e275ac0b96b8f12 - MD5:
de1c117bd434f8ac8f3d39e05920f28a - imphash:
00dc80a4e597bee8c7ee3e2c1d4a9cde - ssdeep:
12288:Pfgv3KYnXlX4qdIrZBjDzZTph8a8/deXddu:O3KYnXlX4q6P172M3u - TLSH:
T1F552D1E9A7314632FEC999206336905C6933EEE340F5DBDC89959CD9A3CA1F720A5034 - Submitted as: 76d312d640f74edf963d950003541478183caf5ad6f73809bfa06e25ad04da2e
- File type: pe · Size: 999424 bytes
- Verdict: malicious (98/100) · Family: Dridex
Detections (4 of 56 engines)
- ClamAV (daily): Win.Dropper.Dridex-10027551-0
- Microsoft Defender: Trojan:Win64/Dridex.QM!MTB
- Trellix Stinger (McAfee): Drixed-FJX!DE1C117BD434
- Kaspersky (KVRT): HEUR:Trojan.Win64.Injexa.pef
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Dridex-10027551-0 (rule
Win.Dropper.Dridex-10027551-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win64/Dridex.QM!MTB (rule
Trojan:Win64/Dridex.QM!MTB) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Drixed-FJX!DE1C117BD434 (rule
Drixed-FJX!DE1C117BD434) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Injexa.pef (rule
HEUR:Trojan.Win64.Injexa.pef) - engine signal, weight 0.55, confidence 0.85
Dynamic analysis (windows)
71505 behavior events · 1 ATT&CK techniques · 18 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db -
9485004cd1994df7dec947b63588eee4de069ea4e648abcee74abea6b423f44a - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db -
ddb47d7eca51cc0b93fff3080fa18bceaf85812db75223fd93f6400c4da6759d - C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db -
7f4e824fc48443e0eba51bc4f486297952ee474067140ad9cb51ef51d4742e6d - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000025.db -
21098e991b46c5fa285a51b04dca8d067313a3d6dd076d64c438e5a3374bf7d4 - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db -
e175f5db1c6d7ac32b554cfe9d9aeec43957a0520544bb149d91850bd7c2386b - e1a938ce4c1bf2d692e57e1c918c6d09f82e6e3ba740bc92eb94c614f8b4846c -
e1a938ce4c1bf2d692e57e1c918c6d09f82e6e3ba740bc92eb94c614f8b4846c - 85aa75a7410e21851e71648d94a9137d57cf2c3d4c0264e7b4cfbbb4465c7cfa -
85aa75a7410e21851e71648d94a9137d57cf2c3d4c0264e7b4cfbbb4465c7cfa - 34b2e4fc9a56fc631b88c28bd9559c02698fbb7f125c55c2d122bb119bf6d325 -
34b2e4fc9a56fc631b88c28bd9559c02698fbb7f125c55c2d122bb119bf6d325 - 4aadec465b243cb977706e574b2bbed70e632b29a245bf30200864dee87a3d87 -
4aadec465b243cb977706e574b2bbed70e632b29a245bf30200864dee87a3d87 - f06d4ef2d465c8cbe90eb2f222ecbfe3d8cbf9a9782d882c8ee3ea748a848621 -
f06d4ef2d465c8cbe90eb2f222ecbfe3d8cbf9a9782d882c8ee3ea748a848621 - f6371d6126f6e667229ddc537435a303792d954296bc73927aa978ad774e0221 -
f6371d6126f6e667229ddc537435a303792d954296bc73927aa978ad774e0221 - b2c865118e66c475ce689c5f3dfc1a0b5d791773849581781efc48b7ef64382b -
b2c865118e66c475ce689c5f3dfc1a0b5d791773849581781efc48b7ef64382b - 14552f3bef42907d22f1586b4a306b8c7d00c5113321e61a1a800758e083b32f -
14552f3bef42907d22f1586b4a306b8c7d00c5113321e61a1a800758e083b32f - 87b5fe7e7b067aed3c9387a5ac3d701e3698a7bcb7fd5c2dd4bba3a50d199d6a -
87b5fe7e7b067aed3c9387a5ac3d701e3698a7bcb7fd5c2dd4bba3a50d199d6a - b1c099eda4a21fd9ffb3f28a54e61ed03817df2c5d70e8224d4b74554ba4295f -
b1c099eda4a21fd9ffb3f28a54e61ed03817df2c5d70e8224d4b74554ba4295f
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 4.207.44.71
- 52.123.252.229
- 4.230.171.124
- 85.210.196.11
- 20.165.94.63
- 4.144.132.114
- 74.178.240.51
- 20.184.175.11
- 51.116.246.105
- 20.42.73.24
- 20.42.73.26
- 52.110.12.33
- 52.110.12.21
- 52.110.12.54
- 52.110.12.1
- 135.234.160.244
- 135.233.45.221
- 52.148.114.188
- 52.123.252.198
- 52.123.252.215
- 72.154.7.96
More Dridex samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report