dridex | 0f63e8fa69f0d37bfe7ae6c545e19972c9f1432b804dc1d051bfc1ceed49afa4

Analysis

max time kernel
45s
max time network
123s
platform
windows10_x64
resource
win10
submitted
07/09/2020, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zxc.zip.dll
Size 328KB
Sample200907-h6m296afb2
SHA256 0f63e8fa69f0d37bfe7ae6c545e19972c9f1432b804dc1d051bfc1ceed49afa4
MD5 fc931200c50468e6b2d94aca5e4fb848
SHA1 ae415e95a9f51adcaf1516b7088bd37386b6a486
SHA512 a67aa486178842d2206fa0b78b414fd26429b2a47054e9a41cddc6817986f4bd54193751f67a3e1f33cd201e67ae9eacafcea6115237f8ca163fd75adafe328b
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

45.79.8.25:443
185.201.9.197:9443
217.160.78.166:4664
108.175.9.22:33443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/3920-1-0x00000000739C0000-0x00000000739EC000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

resource	yara_rule
behavioral2/memory/3920-1-0x00000000739C0000-0x00000000739EC000-memory.dmp	dridex_ldr_dmod

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = cb1839d51f85d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3872	svchost.exe
Token: SeCreatePagefilePrivilege	3872	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3920	3828	rundll32.exe	67
PID 3828 wrote to memory of 3920	3828	rundll32.exe	67
PID 3828 wrote to memory of 3920	3828	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxc.zip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zxc.zip.dll,#1
  2⤵
  PID:3920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-1-0x00000000739C0000-0x00000000739EC000-memory.dmp

Download