dridex | b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895 | Triage™

Analysis

max time kernel
102s
max time network
110s
platform
windows10_x64
resource
win10v200722
submitted
07/10/2020, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd1e5cf467316c24f4a99e4d904ed28e.dll
Size 473KB
Sample201007-3rwchzjftj
SHA256 b775a1f8663e7bdeef07cdd7497b91fa82dd7ab1015d138b2aeb8b51e77d3895
MD5 bd1e5cf467316c24f4a99e4d904ed28e
SHA1 7427287604e93881e59bf3b7685a470ac589682e
SHA512 5083f7b2a18cd7b2f8e4b254c7b01147c5de30eb96f99a09ef5015f5975fe11d99cf8d8bc26d72d4259c353fc8b79cde1938379b1dcdd092bf589e9aa97bb0e7
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

177.87.70.3:443
213.133.102.195:3889
27.254.174.93:33443
27.254.174.77:4443

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1300-1-0x0000000073850000-0x000000007388D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 1300	3956	rundll32.exe	71
PID 3956 wrote to memory of 1300	3956	rundll32.exe	71
PID 3956 wrote to memory of 1300	3956	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd1e5cf467316c24f4a99e4d904ed28e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd1e5cf467316c24f4a99e4d904ed28e.dll,#1
  2⤵
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-1-0x0000000073850000-0x000000007388D000-memory.dmp

Download