MALICIOUS — f1e21b0368a21d1ee8d28e07d9b1601e0d9adfd016b5e9273ab20ee293fe93c9
MALICIOUS — f1e21b0368a21d1ee8d28e07d9b1601e0d9adfd016b5e9273ab20ee293fe93c9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Dridex family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
f1e21b0368a21d1ee8d28e07d9b1601e0d9adfd016b5e9273ab20ee293fe93c9 - SHA-1:
b24990540a6ee20925851445b054bd5ad09a28aa - MD5:
649b605cd362e54a8096ef8254ec9e20 - imphash:
00dc80a4e597bee8c7ee3e2c1d4a9cde - ssdeep:
12288:Efgv3KYnXlX4qdIrZBjDzZTph8a8/deXddueT:53KYnXlX4q6P172M3ueT - TLSH:
T13753D1E9A7318232FED999206335A04C6D33DEE340F9DBDDC99598D9A3861B320B5035 - Submitted as: f1e21b0368a21d1ee8d28e07d9b1601e0d9adfd016b5e9273ab20ee293fe93c9
- File type: pe · Size: 1024000 bytes
- Verdict: malicious (98/100) · Family: Dridex
Detections (4 of 56 engines)
- ClamAV (daily): Win.Dropper.Dridex-10027551-0
- Microsoft Defender: Trojan:Win64/Dridex.QM!MTB
- Trellix Stinger (McAfee): Drixed-FJX!649B605CD362
- Kaspersky (KVRT): HEUR:Trojan.Win64.Injexa.pef
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Dridex-10027551-0 (rule
Win.Dropper.Dridex-10027551-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win64/Dridex.QM!MTB (rule
Trojan:Win64/Dridex.QM!MTB) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Drixed-FJX!649B605CD362 (rule
Drixed-FJX!649B605CD362) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Injexa.pef (rule
HEUR:Trojan.Win64.Injexa.pef) - engine signal, weight 0.55, confidence 0.85
Dynamic analysis (windows)
99692 behavior events · 2 ATT&CK techniques · 23 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db -
728b8f3702a0ef61069853dccb8645b06d4d6e04d5d7017b95492ef335e6e260 - C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db -
bf10e54e7d5494e7dd941cc33c8b2feb4f815c37d2e7e8bc88c5b3d9ae06a65d - C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db -
52cde4f354b8eab4976ceba25b58cbd7efcdf7ccc3871bfe9d9d040850e84d33 - C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db -
c13e3831d51a253de4704d1092ed5e92477558143857ad89fbf0bca98938d671 - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db -
584fcb512707f15cb6beb7bffa73a12ab60e21684881d78d1f9d610f998e3fcc - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db -
9813cd88b46107c4dc38d1a8786afe1f1ce06795774f2b72ce7647b444134b63 - C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db -
6a1eea74c5cb6e55d8caf20ea30cf861af80cc27a8fe549e8255edc3c4b67623 - 31a9e9d5cef4fd4e7c32d782951d0bd1ab0ed6c43cab560ca6c0080869bfd7a7 -
31a9e9d5cef4fd4e7c32d782951d0bd1ab0ed6c43cab560ca6c0080869bfd7a7 - b2cef4caad67e88d5e55b70e7e42b974055c22d4ec97492152047165b909b12e -
b2cef4caad67e88d5e55b70e7e42b974055c22d4ec97492152047165b909b12e - 34b2e4fc9a56fc631b88c28bd9559c02698fbb7f125c55c2d122bb119bf6d325 -
34b2e4fc9a56fc631b88c28bd9559c02698fbb7f125c55c2d122bb119bf6d325 - 8ed783a69bb012112c7a193c674a9d34295713f04bcb5435dd5ce4e363e471ac -
8ed783a69bb012112c7a193c674a9d34295713f04bcb5435dd5ce4e363e471ac - 62375771444e16f9b2b889ca44474a6af2ae4fa3f15ccd8b1d016ee29beb50f4 -
62375771444e16f9b2b889ca44474a6af2ae4fa3f15ccd8b1d016ee29beb50f4 - 3c9e18d7f3f9433cfdcceb3622ceb776e2b69646a630c49290f8e373190979ab -
3c9e18d7f3f9433cfdcceb3622ceb776e2b69646a630c49290f8e373190979ab - dda6d3d3dc710fd08dc2c65fa56066a432932ba51102fbf6a45159ce3398b7f7 -
dda6d3d3dc710fd08dc2c65fa56066a432932ba51102fbf6a45159ce3398b7f7 - 555ed62ec361f7c0a751f11aafc38740e4932b738d769c29d8136ab97ff8aa71 -
555ed62ec361f7c0a751f11aafc38740e4932b738d769c29d8136ab97ff8aa71
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- oneclient.sfx.ms
Embedded IP addresses
- 13.89.179.15
- 4.230.171.124
- 20.42.179.192
- 20.42.179.204
- 20.247.185.124
- 135.232.92.97
- 74.179.77.204
- 4.150.223.96
- 20.165.94.63
- 52.110.12.47
- 52.110.12.10
- 135.234.160.244
- 172.178.240.162
- 52.148.114.188
- 52.123.252.236
- 57.155.101.212
- 4.150.223.101
- 20.184.175.11
- 57.155.104.224
- 4.150.223.105
- 48.211.4.16
- 4.247.188.233
- 52.123.129.14
- 52.123.252.231
- 172.172.255.216
More Dridex samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report