MALICIOUS — b046be75b3ccd6fde4dbf054b4e307ff5ab4ff20fbcad9dd94d88e017959ab3c
MALICIOUS — b046be75b3ccd6fde4dbf054b4e307ff5ab4ff20fbcad9dd94d88e017959ab3c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Dridex family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
b046be75b3ccd6fde4dbf054b4e307ff5ab4ff20fbcad9dd94d88e017959ab3c - SHA-1:
408ca6470c83d3e7a9fcf6c39fadd1cca2ad2cc7 - MD5:
1aec5f4fe58ac86b2c8e62086574c6c0 - imphash:
00dc80a4e597bee8c7ee3e2c1d4a9cde - ssdeep:
12288:Dfgv3KYnXlX4qdIrZBjDzZTph8a8/deXdduX:i3KYnXlX4q6P172M3u - TLSH:
T18B52D1E9A7714632FEC999206336905C6933EEE340F9DBDC89959CD5A3CA1F720A5030 - Submitted as: b046be75b3ccd6fde4dbf054b4e307ff5ab4ff20fbcad9dd94d88e017959ab3c
- File type: pe · Size: 999424 bytes
- Verdict: malicious (98/100) · Family: Dridex
Detections (4 of 56 engines)
- ClamAV (daily): Win.Dropper.Dridex-10027551-0
- Microsoft Defender: Trojan:Win64/Dridex.QM!MTB
- Trellix Stinger (McAfee): Drixed-FJX!1AEC5F4FE58A
- Kaspersky (KVRT): HEUR:Trojan.Win64.Injexa.pef
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Dridex-10027551-0 (rule
Win.Dropper.Dridex-10027551-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win64/Dridex.QM!MTB (rule
Trojan:Win64/Dridex.QM!MTB) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Drixed-FJX!1AEC5F4FE58A (rule
Drixed-FJX!1AEC5F4FE58A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Injexa.pef (rule
HEUR:Trojan.Win64.Injexa.pef) - engine signal, weight 0.55, confidence 0.85
Dynamic analysis (windows)
70645 behavior events · 2 ATT&CK techniques · 19 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000025.db -
90a6b858fb38ded6994a6060c0f03ad2dc125c29a5a83178aa3ce814e63f97e3 - C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db -
7f4e824fc48443e0eba51bc4f486297952ee474067140ad9cb51ef51d4742e6d - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db -
0dd6cc1c578659f4d921d2ced526fc37b580dc68742ce817a6eb4105658a499d - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000026.db -
65161020df5e8c75f31a656315866380ebc280248dc190825c8944bd5db90f2c - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db -
b44c8ab43cb9b16c52273100b2da78dbab7545feef40989d1c084c58f37c3dc0 - a4620d8d94a60db354839daad626d899e7b43270b69b8e62745fccef70ce459c -
a4620d8d94a60db354839daad626d899e7b43270b69b8e62745fccef70ce459c - 635cd0858dd223958860db3f990b489454931a648f78f4e2d0c922234794803e -
635cd0858dd223958860db3f990b489454931a648f78f4e2d0c922234794803e - a92012a65f352b1f58b5b7a5a29ec897a9a6a75ec8e06fe42b400b11f24a8fb7 -
a92012a65f352b1f58b5b7a5a29ec897a9a6a75ec8e06fe42b400b11f24a8fb7 - 34b2e4fc9a56fc631b88c28bd9559c02698fbb7f125c55c2d122bb119bf6d325 -
34b2e4fc9a56fc631b88c28bd9559c02698fbb7f125c55c2d122bb119bf6d325 - a72ec8a0d9fceb414d4951f65150e1ae24663acd5e31b51ed3b2f9d4ce32b75c -
a72ec8a0d9fceb414d4951f65150e1ae24663acd5e31b51ed3b2f9d4ce32b75c - 868015c6420f98200c5327846382a5dc2bdaa3ee32c34cb459bf3229d2a070b4 -
868015c6420f98200c5327846382a5dc2bdaa3ee32c34cb459bf3229d2a070b4 - 8926068b45df2aa0898c05cc58844fd7c6438dc12f793391a8bcd5ac97e055d8 -
8926068b45df2aa0898c05cc58844fd7c6438dc12f793391a8bcd5ac97e055d8 - 4b71139f991d61fd74cfc81db7f39a7965b563b94b7bd50d8db0c09181e30881 -
4b71139f991d61fd74cfc81db7f39a7965b563b94b7bd50d8db0c09181e30881 - 14552f3bef42907d22f1586b4a306b8c7d00c5113321e61a1a800758e083b32f -
14552f3bef42907d22f1586b4a306b8c7d00c5113321e61a1a800758e083b32f - 8eb12e278e74374a17c4f480ab84149db0b8a8dc06a208fb166d8be2d3f044f7 -
8eb12e278e74374a17c4f480ab84149db0b8a8dc06a208fb166d8be2d3f044f7
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 184.84.165.168
- 40.79.167.10
- 4.230.171.124
- 85.210.196.11
- 4.155.89.87
- 74.178.76.54
- 74.178.76.128
- 4.150.223.111
- 172.64.154.167
- 52.168.117.174
- 20.165.94.63
- 51.132.193.104
- 52.178.17.2
- 52.110.12.3
- 52.110.12.14
- 52.110.12.18
- 52.110.12.22
- 172.178.240.162
- 135.233.45.221
- 172.178.240.163
- 52.123.252.248
- 52.148.114.188
- 172.215.188.232
- 52.110.12.56
- 72.153.5.63
More Dridex samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report