dridex | 92794ce2b86f5636b0636952f7ac4b02f0fd664b5f479372d64aa779d376a7a2 | Triage™

Analysis

max time kernel
19s
max time network
115s
platform
windows10_x64
resource
win10
submitted
24/09/2020, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRIDEX (6).dll
Size 320KB
Sample200924-wfe8bfpfcx
SHA256 92794ce2b86f5636b0636952f7ac4b02f0fd664b5f479372d64aa779d376a7a2
MD5 4b7a60d7db351a62304d9659b7e39f57
SHA1 1f8b09ad1ff3fce962fac3fa2aebca346eb7d7a6
SHA512 16c68240bc90f9a70f00df8ba74d15dad73cdd30a1cd541a9013340c1f906270d717690a5ce0b8b3dd7c2bf7163d3ffa87283edd310da5f5377d1e332c9bf0fb
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3860-1-0x00000000741C0000-0x00000000741FD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3860	3832	rundll32.exe	67
PID 3832 wrote to memory of 3860	3832	rundll32.exe	67
PID 3832 wrote to memory of 3860	3832	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DRIDEX (6).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DRIDEX (6).dll",#1
  2⤵
  PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-1-0x00000000741C0000-0x00000000741FD000-memory.dmp

Download