MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 11

Maldoc score: 6

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c
SHA3-384 hash:	89e49fdf7defdf881aad413e304168599daeb3822cdd21497830f8cfcf642423bc26bc6d3dbbf4f4c86b5f9ace1bbdf7
SHA1 hash:	425de0627c45d39118b4ab7e15e07fc97df1f31f
MD5 hash:	0b1145386e54c133263fc6e8a9a71ed5
humanhash:	twenty-ceiling-london-artist
File name:	taxve_554964502_20210816_85994972_572710651.xlsm
Download:	download sample
Signature	Dridex Create hunting rule
File size:	239'458 bytes
First seen:	2021-08-16 17:18:47 UTC
Last seen:	Never
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	3072:SjAeN0RKSwCchO7e/1GrpdXx6sj848QjWvpGtdWWDDEAB7VaQFhIcB6tOVRa1J:SDNSLcq+YXEsWpGj53ha7o+0O
TLSH	T10E34011985B3E565E8DB507E4C9E0FDD17B18E2F06D02B42F9E2E64DAD18EE311812C7
Reporter	abuse_ch
Tags:	22201 Dridex xlsm

abuse_ch

Dridex payload URLs:
https://mercedes190portugal.com/old/dI002Nt3U7U5Fm.php
https://cdn.discordapp.com/attachments/876792192524501045/876837913906774076/1.dll

Dridex C2s:
134.209.182.12:443
188.40.100.254:4664
103.109.247.9:10443

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 6

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
Base64	7_4	N180
Base64	C_4	Q180
Base64	G_4	R180
Base64	K_4	S180
Base64	O_4	T180
Base64	S_4	U180
Base64	W_4	V180
Base64	__4	X180
Base64	7_5	N181
Base64	C_5	Q181
Base64	G_5	R181
Base64	K_5	S181
Base64	O_5	T181
Base64	S_5	U181
Base64	W_5	V181
Base64	__5	X181
Base64	7_6	N182
Base64	C_6	Q182
Base64	G_6	R182
Base64	K_6	S182
Base64	O_6	T182
Base64	S_6	U182
Base64	W_6	V182
Base64	__6	X182
Base64	7_7	N183
Base64	C_7	Q183
Base64	G_7	R183
Base64	K_7	S183
Base64	O_7	T183
Base64	S_7	U183
Base64	W_7	V183
Base64	__7	X183
Base64	7_8	N184
Base64	C_8	Q184
Base64	G_8	R184
Base64	K_8	S184
Base64	O_8	T184
Base64	S_8	U184
Base64	W_8	V184
Base64	__8	X184
Base64	7_9	N185
Base64	C_9	Q185
Base64	G_9	R185
Base64	K_9	S185
Base64	O_9	T185
Base64	S_9	U185
Base64	W_9	V185
Base64	__9	X185
Base64	7_t	N190
Base64	C_t	Q190
Base64	G_t	R190
Base64	K_t	S190
Base64	O_t	T190
Base64	S_t	U190
Base64	W_t	V190
Base64	__t	X190
Base64	7_u	N191
Base64	C_u	Q191
Base64	G_u	R191
Base64	K_u	S191
Base64	O_u	T191
Base64	S_u	U191
Base64	W_u	V191
Base64	__u	X191
Base64	7_v	N192
Base64	C_v	Q192
Base64	G_v	R192
Base64	K_v	S192
Base64	O_v	T192
Base64	S_v	U192
Base64	W_v	V192
Base64	__v	X192
Base64	7_w	N193
Base64	C_w	Q193
Base64	G_w	R193
Base64	K_w	S193
Base64	O_w	T193
Base64	S_w	U193
Base64	W_w	V193
Base64	__w	X193
Base64	7_x	N194
Base64	C_x	Q194
Base64	G_x	R194
Base64	K_x	S194
Base64	O_x	T194
Base64	S_x	U194
Base64	W_x	V194
Base64	__x	X194
Base64	7_y	N195
Base64	C_y	Q195
Base64	G_y	R195
Base64	K_y	S195
Base64	O_y	T195
Base64	S_y	U195
Base64	W_y	V195
Base64	__y	X195
Base64	7_z	N196
Base64	C_z	Q196
Base64	G_z	R196
Base64	K_z	S196
Base64	O_z	T196
Base64	S_z	U196
Base64	W_z	V196
Base64	__z	X196
Base64	7m4	N200
Base64	Cm4	Q200
Base64	Gm4	R200
Base64	Km4	S200
Base64	Om4	T200
Base64	Sm4	U200
Base64	Wm4	V200
Base64	_m4	X200
Base64	7m5	N201
Base64	Cm5	Q201
Base64	Gm5	R201
Base64	Km5	S201
Base64	Om5	T201
Base64	Sm5	U201
Base64	Wm5	V201
Base64	_m5	X201
Base64	7m6	N202
Base64	Cm6	Q202
Base64	Gm6	R202
Base64	Km6	S202
Base64	Om6	T202
Base64	Sm6	U202
Base64	Wm6	V202
Base64	_m6	X202
Base64	7m7	N203
Base64	Cm7	Q203
Base64	Gm7	R203
Base64	Km7	S203
Base64	Om7	T203
Base64	Sm7	U203
Base64	Wm7	V203
Base64	_m7	X203
Base64	7m8	N204
Base64	Cm8	Q204
Base64	Gm8	R204
Base64	Km8	S204
Base64	Om8	T204
Base64	Sm8	U204
Base64	Wm8	V204
Base64	_m8	X204
Base64	7m9	N205
Base64	Cm9	Q205
Base64	Gm9	R205
Base64	Km9	S205
Base64	Om9	T205
Base64	Sm9	U205
Base64	Wm9	V205
Base64	_m9	X205
Base64	7mt	N210
Base64	Cmt	Q210
Base64	Gmt	R210
Base64	Kmt	S210
Base64	Omt	T210
Base64	Smt	U210
Base64	Wmt	V210
Base64	_mt	X210
Base64	7mu	N211
Base64	Cmu	Q211
Base64	Gmu	R211
Base64	Kmu	S211
Base64	Omu	T211
Base64	Smu	U211
Base64	Wmu	V211
Base64	_mu	X211
Base64	7mv	N212
Base64	Cmv	Q212
Base64	Gmv	R212
Base64	Kmv	S212
Base64	Omv	T212
Base64	Smv	U212
Base64	Wmv	V212
Base64	_mv	X212
Base64	7mw	N213
Base64	Cmw	Q213
Base64	Gmw	R213
Base64	Kmw	S213
Base64	Omw	T213
Base64	Smw	U213
Base64	Wmw	V213
Base64	_mw	X213
Base64	7mx	N214
Base64	Cmx	Q214
Base64	Gmx	R214
Base64	Kmx	S214
Base64	Omx	T214
Base64	Smx	U214
Base64	Wmx	V214
Base64	_mx	X214
Base64	7my	N215
Base64	Cmy	Q215
Base64	Gmy	R215
Base64	Kmy	S215
Base64	Omy	T215
Base64	Smy	U215
Base64	Wmy	V215
Base64	_my	X215
Base64	7mz	N216
Base64	Cmz	Q216
Base64	Gmz	R216
Base64	Kmz	S216
Base64	Omz	T216
Base64	Smz	U216
Base64	Wmz	V216
Base64	_mz	X216
Base64	7n4	N240
Base64	Cn4	Q240
Base64	Gn4	R240
Base64	Kn4	S240
Base64	On4	T240
Base64	Sn4	U240
Base64	Wn4	V240
Base64	_n4	X240
Base64	7n5	N241
Base64	Cn5	Q241
Base64	Gn5	R241
Base64	Kn5	S241
Base64	On5	T241
Base64	Sn5	U241
Base64	Wn5	V241
Base64	_n5	X241
Base64	7n6	N242
Base64	Cn6	Q242
Base64	Gn6	R242
Base64	Kn6	S242
Base64	On6	T242
Base64	Sn6	U242
Base64	Wn6	V242
Base64	_n6	X242
Base64	7n7	N243
Base64	Cn7	Q243
Base64	Gn7	R243
Base64	Kn7	S243
Base64	On7	T243
Base64	Sn7	U243
Base64	Wn7	V243
Base64	_n7	X243
Base64	7n8	N244
Base64	Cn8	Q244
Base64	Gn8	R244
Base64	Kn8	S244
Base64	On8	T244
Base64	Sn8	U244
Base64	Wn8	V244
Base64	_n8	X244
Base64	7n9	N245
Base64	Cn9	Q245
Base64	Gn9	R245
Base64	Kn9	S245
Base64	On9	T245
Base64	Sn9	U245
Base64	Wn9	V245
Base64	_n9	X245
Base64	7nt	N250
Base64	Cnt	Q250
Base64	Gnt	R250
Base64	Knt	S250
Base64	Ont	T250
Base64	Snt	U250
Base64	Wnt	V250
Base64	_nt	X250
Base64	7nu	N251
Base64	Cnu	Q251
Base64	Gnu	R251
Base64	Knu	S251
Base64	Onu	T251
Base64	Snu	U251
Base64	Wnu	V251
Base64	_nu	X251
Base64	7nv	N252
Base64	Cnv	Q252
Base64	Gnv	R252
Base64	Knv	S252
Base64	Onv	T252
Base64	Snv	U252
Base64	Wnv	V252
Base64	_nv	X252
Base64	7nw	N253
Base64	Cnw	Q253
Base64	Gnw	R253
Base64	Knw	S253
Base64	Onw	T253
Base64	Snw	U253
Base64	Wnw	V253
Base64	_nw	X253
Base64	7nx	N254
Base64	Cnx	Q254
Base64	Gnx	R254
Base64	Knx	S254
Base64	Onx	T254
Base64	Snx	U254
Base64	Wnx	V254
Base64	_nx	X254
Base64	7ny	N255
Base64	Cny	Q255
Base64	Gny	R255
Base64	Kny	S255
Base64	Ony	T255
Base64	Sny	U255
Base64	Wny	V255
Base64	_ny	X255
Base64	7nz	N256
Base64	Cnz	Q256
Base64	Gnz	R256
Base64	Knz	S256
Base64	Onz	T256
Base64	Snz	U256
Base64	Wnz	V256
Base64	_nz	X256
Base64	7o4	N280
Base64	Co4	Q280
Base64	Go4	R280
Base64	Ko4	S280
Base64	Oo4	T280
Base64	So4	U280
Base64	Wo4	V280
Base64	_o4	X280
Base64	7o5	N281
Base64	Co5	Q281
Base64	Go5	R281
Base64	Ko5	S281
Base64	Oo5	T281
Base64	So5	U281
Base64	Wo5	V281
Base64	_o5	X281
Base64	7o6	N282
Base64	Co6	Q282
Base64	Go6	R282
Base64	Ko6	S282
Base64	Oo6	T282
Base64	So6	U282
Base64	Wo6	V282
Base64	_o6	X282
Base64	7o7	N283
Base64	Co7	Q283
Base64	Go7	R283
Base64	Ko7	S283
Base64	Oo7	T283
Base64	So7	U283
Base64	Wo7	V283
Base64	_o7	X283
Base64	7o8	N284
Base64	Co8	Q284
Base64	Go8	R284
Base64	Ko8	S284
Base64	Oo8	T284
Base64	So8	U284
Base64	Wo8	V284
Base64	_o8	X284
Base64	7o9	N285
Base64	Co9	Q285
Base64	Go9	R285
Base64	Ko9	S285
Base64	Oo9	T285
Base64	So9	U285
Base64	Wo9	V285
Base64	_o9	X285
Base64	7ot	N290
Base64	Cot	Q290
Base64	Got	R290
Base64	Kot	S290
Base64	Oot	T290
Base64	Sot	U290
Base64	Wot	V290
Base64	_ot	X290
Base64	7ou	N291
Base64	Cou	Q291
Base64	Gou	R291
Base64	Kou	S291
Base64	Oou	T291
Base64	Sou	U291
Base64	Wou	V291
Base64	_ou	X291
Base64	7ov	N292
Base64	Cov	Q292
Base64	Gov	R292
Base64	Kov	S292
Base64	Oov	T292
Base64	Sov	U292
Base64	Wov	V292
Base64	_ov	X292
Base64	7ow	N293
Base64	Cow	Q293
Base64	Gow	R293
Base64	Kow	S293
Base64	Oow	T293
Base64	Sow	U293
Base64	Wow	V293
Base64	_ow	X293
Base64	7ox	N294
Base64	Cox	Q294
Base64	Gox	R294
Base64	Kox	S294
Base64	Oox	T294
Base64	Sox	U294
Base64	Wox	V294
Base64	_ox	X294
Base64	7oy	N295
Base64	Coy	Q295
Base64	Goy	R295
Base64	Koy	S295
Base64	Ooy	T295
Base64	Soy	U295
Base64	Woy	V295
Base64	_oy	X295
Base64	7oz	N296
Base64	Coz	Q296
Base64	Goz	R296
Base64	Koz	S296
Base64	Ooz	T296
Base64	Soz	U296
Base64	Woz	V296
Base64	_oz	X296
Suspicious	EXEC	May run an executable file or a system
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	XLM macrosheet	XLM macrosheet found. It could contain malicious code

Intelligence

File Origin

# of uploads :

# of downloads :

192

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

taxve_554964502_20210816_85994972_572710651.xlsm

Verdict:

Malicious activity

Analysis date:

2021-08-16 17:21:31 UTC

Tags:

macros40

Link:

https://app.any.run/tasks/fb9e5fb8-a35f-40b1-ab1f-11f2243bb863

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/vnd.ms-excel.sheet.macroEnabled.12

Has a screenshot:

False

Contains macros:

False

Detection:

Feodo

Link:

https://www.capesandbox.com/analysis/179649/

Detection(s):

TwinWave.EvilDoc.DOCXSTRGOOD..SCT.210816.UNOFFICIAL

SecuriteInfo.com.MSOffice.DdeExec-3.UNOFFICIAL

TwinWave.EvilDoc.XLMSumBodyToLove.M2.032421.UNOFFICIAL

TwinWave.EvilDoc.DridexNoParticularPlaceToGo.20210813.UNOFFICIAL

TwinWave.EvilDoc.DridexNoParticularPlaceToGo.20210816.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Creating a process with a hidden window

DNS request

Connection attempt

Sending a custom TCP request

Launching a process

Sending a UDP request

Launching a process by exploiting the app vulnerability

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c/results/dashboard

Document image

Image:

Download PNG

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/833729

Signature

Document exploit detected (creates forbidden files)

Document exploit detected (process start blacklist hit)

Microsoft Office creates scripting files

Sigma detected: Microsoft Office Product Spawning Windows Shell

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c/

Threat name:

Script.Trojan.IcedID

Status:

Malicious

First seen:

2021-08-16 17:19:06 UTC

AV detection:

4 of 46 (8.70%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6azdjzu4lehdr6yzyfobtinrkjw2ddlovdjggsxj7wa5x5iwrmwa._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:22201 botnet evasion loader macro trojan xlm

Link:

https://tria.ge/reports/210816-wjasrxwyna/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks whether UAC is enabled

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Dridex Loader

Dridex

Process spawned unexpected child process

Malware Config

C2 Extraction:

134.209.182.12:443
188.40.100.254:4664
103.109.247.9:10443

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f03234e69c59/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Microsoft_XLSX_with_Macrosheet Create hunting rule

Rule name:	Microsoft_XLSX_with_Macrosheet Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

xlsm f03234e69c590e38fb19c15c19a1b1526da18d6ea8d2634ae9fd81dbf5168b2c

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1539232/

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/179649/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample