dridex | 0f63e8fa69f0d37bfe7ae6c545e19972c9f1432b804dc1d051bfc1ceed49afa4

Analysis

max time kernel
62s
max time network
10s
platform
windows7_x64
resource
win7v200722
submitted
07/09/2020, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zxc.zip.dll
Size 328KB
Sample200907-h6m296afb2
SHA256 0f63e8fa69f0d37bfe7ae6c545e19972c9f1432b804dc1d051bfc1ceed49afa4
MD5 fc931200c50468e6b2d94aca5e4fb848
SHA1 ae415e95a9f51adcaf1516b7088bd37386b6a486
SHA512 a67aa486178842d2206fa0b78b414fd26429b2a47054e9a41cddc6817986f4bd54193751f67a3e1f33cd201e67ae9eacafcea6115237f8ca163fd75adafe328b
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

45.79.8.25:443
185.201.9.197:9443
217.160.78.166:4664
108.175.9.22:33443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral1/memory/1620-1-0x00000000750B0000-0x00000000750DC000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

resource	yara_rule
behavioral1/memory/1620-1-0x00000000750B0000-0x00000000750DC000-memory.dmp	dridex_ldr_dmod

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24
PID 1424 wrote to memory of 1620	1424	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxc.zip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxc.zip.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-1-0x00000000750B0000-0x00000000750DC000-memory.dmp

Download