dridex | 2ee89b249239c74f9862bd5da57e36780142f8a5cbaecda5d102cae097d6cfd6

Analysis

max time kernel
20s
max time network
134s
platform
windows10_x64
resource
win10v200722
submitted
08/09/2020, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
150f42ff16bd2ae9895532a7be6284a1.dll
Size 328KB
Sample200908-7pnybjs41n
SHA256 2ee89b249239c74f9862bd5da57e36780142f8a5cbaecda5d102cae097d6cfd6
MD5 150f42ff16bd2ae9895532a7be6284a1
SHA1 f8b19d6c5624e562f3ec9a1ef33f33e6b9313a8e
SHA512 639cf79502f678c6b9d0107736d9962ed76dbe24107749f88a560a69497568ce0c2258d3d2101c8bd10a270160fdeda8f3a4e8c466b57311047fd1a754ff085a
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

45.79.8.25:443
185.201.9.197:9443
217.160.78.166:4664
108.175.9.22:33443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/1012-1-0x00000000741F0000-0x000000007421C000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

resource	yara_rule
behavioral2/memory/1012-1-0x00000000741F0000-0x000000007421C000-memory.dmp	dridex_ldr_dmod

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = ee2e74adc485d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	704	svchost.exe
Token: SeCreatePagefilePrivilege	704	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 1012	584	rundll32.exe	67
PID 584 wrote to memory of 1012	584	rundll32.exe	67
PID 584 wrote to memory of 1012	584	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\150f42ff16bd2ae9895532a7be6284a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\150f42ff16bd2ae9895532a7be6284a1.dll,#1
  2⤵
  PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-1-0x00000000741F0000-0x000000007421C000-memory.dmp

Download