dridex | 6ca299c9f6d8e9203359a337f23ed72aba684db02f05dc2153a81586cf006a8b

Analysis

max time kernel
17s
max time network
140s
platform
windows10_x64
resource
win10v200722
submitted
07-08-2020 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ca299c9f6d8e9203359a337f23ed72aba684db02f05dc2153a81586cf006a8b.exe
Size

909KB
MD5

d0cf33f6ba7a095cc087f47ab85423cb
SHA1

2cb8e52c015775a59d75ae94f1f46600b7367cf6
SHA256

6ca299c9f6d8e9203359a337f23ed72aba684db02f05dc2153a81586cf006a8b
SHA512

57ae50f327d74b84c6c7b2857dcaf64cebea5ac795c388896f0fa897fec2705fb54c9cad8210a23cacea658695b0cab8758553c1ca621e197f1cab0bfd7ca178

Score

10^/10

dridex 10121 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10121

217.20.166.177:443

54.38.143.246:691

92.38.128.47:3389

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3288-0-0x0000000000400000-0x000000000042C000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3288-0-0x0000000000400000-0x000000000042C000-memory.dmp	dridex_ldr_dmod

C:\Users\Admin\AppData\Local\Temp\6ca299c9f6d8e9203359a337f23ed72aba684db02f05dc2153a81586cf006a8b.exe
"C:\Users\Admin\AppData\Local\Temp\6ca299c9f6d8e9203359a337f23ed72aba684db02f05dc2153a81586cf006a8b.exe"
1⤵
PID:3288

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3288-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download