MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35
SHA3-384 hash: 55681e13f0c779b11ac4e8fa11003b5f59a8ac24e6e5ef772b22a8fb0c02bb32c9d10e8624a53a6eb93211cdfa96ff12
SHA1 hash: 371c3f1ace0a466b1da2ea4773966c3762602c72
MD5 hash: ec7196719cd7072437a15963ec474858
humanhash: eight-low-bravo-texas
File name:4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35
Download: download sample
Signature Dridex
Create hunting rule
File size:1'499'136 bytes
First seen:2021-11-26 09:25:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 72906e44c69f979a7a4dfcb492a7b5bb (28 x Dridex)
ssdeep 12288:CGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7erYb:33JAvRl/fKQKCgFfx4P/vaerY
Threatray 1'665 similar samples on MalwareBazaar
TLSH T1FA658E12F3F311C2C09EF239B8AE0405A1A39E11C96F871DA65F13355C5BB923EAE55B
Reporter JAMESWT_WT
Tags:Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35
Verdict:
No threats detected
Analysis date:
2021-11-26 11:43:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e9975aad-159a-47d9-8464-127258dc9701

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
Win.Malware.Mikey-9910251-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Changing a file
Creating a file
Creating a process from a recently created file
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
DNS request
Setting browser functions hooks
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Unauthorized injection to a browser process
Enabling autorun by creating a file
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61a0a839f36138de3f3e9903/reports/f43a7cad-b7d6-498d-b603-7208f1e9aead/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/db2961ae-ca54-41af-b5d8-557055537db8
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/896836
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
Changes memory attributes in foreign processes to executable or writable
Contains functionality to hide windows to a different desktop
DLL side loading technique detected
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Svchost Process
Uses Atom Bombing / ProGate to inject into other processes
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 529313 Sample: rWsYDO4son Startdate: 26/11/2021 Architecture: WINDOWS Score: 100 43 Antivirus detection for dropped file 2->43 45 Antivirus / Scanner detection for submitted sample 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 4 other signatures 2->49 9 loaddll64.exe 1 2->9         started        process3 process4 11 cmd.exe 1 9->11         started        13 rundll32.exe 9->13         started        15 rundll32.exe 9->15         started        17 rundll32.exe 9->17         started        process5 19 rundll32.exe 11->19         started        signatures6 51 Changes memory attributes in foreign processes to executable or writable 19->51 53 Uses Atom Bombing / ProGate to inject into other processes 19->53 55 Queues an APC in another process (thread injection) 19->55 22 explorer.exe 2 58 19->22 injected process7 file8 35 C:\Users\user\AppData\Local\zsXwd\SYSDM.CPL, PE32+ 22->35 dropped 37 C:\Users\user\AppData\Local\vzDDW\DUser.dll, PE32+ 22->37 dropped 39 C:\Users\user\AppData\Local\...\WTSAPI32.dll, PE32+ 22->39 dropped 41 15 other files (6 malicious) 22->41 dropped 57 Benign windows process drops PE files 22->57 26 tabcal.exe 22->26         started        29 svchost.exe 1 22->29         started        31 CameraSettingsUIHost.exe 22->31         started        33 12 other processes 22->33 signatures9 process10 signatures11 59 Contains functionality to hide windows to a different desktop 26->59 61 DLL side loading technique detected 29->61
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35/
Threat name:
Win64.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 19:51:48 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
31 of 45 (68.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
093afb9fea7c597a845147683a408b2729ac164d66ec0c49a8a330d22fff09ee
Dridex
2510fce2ae8abcf528756824a0af288d3ced8f1bc4250b66384c81aee835e5ff
Dridex
411e4618c1a5a3d3c3f2a5fea9c428f735a667694d848809a07d68557cd4797a
Dridex
433b530c8b0a457ae7a863e4a3c70c80b2df4c9497e3d2833351faf2b19dc0ed
Dridex
8f241220413489fb05abc0610962c84195dd55472744c37521eea39fa1d1335a
Dridex
8f3aada3f4b53e00902e37e055b7d800a220c960b85d3e66cdc1530ec4654500
Dridex
9d76b6de44044e97b5794cd6dd126e5d8409cc55e584f54d4c101cd5d0f96304
Dridex
c8b515be222c5ed644a449557d40cadbef722d8e53d0d248856076381400654a
Dridex
e36c30d1635b10ad1e0958261be9b1eb4b2ef37447281ef3e50ec14233a6e1c6
Dridex
fddc5462138024aacafe472b42510d8ad2147b9225194bf0fae79508ab44d3d6
Dridex
+ 1'655 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion payload persistence trojan
Link:
https://tria.ge/reports/211126-ld769segc5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Adds Run key to start application
Checks whether UAC is enabled
Drops startup file
Loads dropped DLL
Executes dropped EXE
Dridex Shellcode
Dridex
Unpacked files
SH256 hash:
4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35
MD5 hash:
ec7196719cd7072437a15963ec474858
SHA1 hash:
371c3f1ace0a466b1da2ea4773966c3762602c72
Link:
https://www.unpac.me/results/5895dcdc-5b78-428a-9ce3-882d657a7779/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4e16c7179564/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/209647/

Comments