2021-11-02 Dridex IOCs

THREAT IDENTIFICATION:  DRIDEX

SENDER EMAILS
intuit.accounting@intuit.com
intuit.customer.service@intuit.com
intuit.invoice.notification@inluitt.com
intuit.notification@intuit.com
intuit_accountant_service@intuit.com
intuit_alerts@intvit.com
intuit_documents@intuit.com
intuit_documents@tntuuit.com
intuit_feedback@inntutt.com
intuit_invoice_notification@intuit.com
intuit_notification@intuil.com

SUBJECTS
Bill-8971 paid
INV 0272 pending
inv 3476 preapproved
inv-8425 for review
INV-9701 pending
Invoice 780253 failed to charge
Invoice-1704 to confirm
Invoice-60877 preapproved
Order 1055 receipt
Payment 96783 paid
Payment#1400 failed
Payment#9179 failed to charge

MALDOC FILE HASHES
Order 1055.xlsb
673ef74b17fa9d10544080d0679c61a7

Invoice-87514.xlsb
833946836c4f80ca92b2cb093e734b28

Payment 1400.xlsb
d0b8ebf0f56c6a63df32db4de4408ed7

Payment 96783.xlsb
d1b49b375722b0f8d45ad569a8a262fd

inv.3476.xlsb
e07b97652df39bc65851addfbbdaa94e

HTA FILE HASH
excel.rtf
0ca7dce2f5c0a2fbbe33135de32bc6e7

PAYLOAD DOWNLOAD URLS
https://cdn.discordapp.com/attachments/905044663310884887/905079197322584124/IQJgSmdeBBAz.mp3
https://cdn.discordapp.com/attachments/905044663310884887/905081217068728350/DRLQZYJqZwNH.mp3
https://cdn.discordapp.com/attachments/905044663310884887/905078998638411826/gEcfYfEwnLWb.mp3

PAYLOAD FILE HASHES
I did not get a payload today.

DRIDEX C2
I did not get a payload today.

SUPORTING EVIDENCE
https://urlhaus.abuse.ch/browse.php?search=https%3A%2F%2Fcdn.discordapp.com%2Fattachments%2F905044663310884887%2F