dridex | 76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc | Triage™

Analysis

max time kernel
49s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
12/11/2020, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c18c1480220ab6655dc37e90e056adf.dll
Size 176KB
Sample201112-jckdmqlqcs
SHA256 76506e2eab776fca3b25d360c68d7be1fd5f55063319c1977b78634624d29bcc
MD5 3c18c1480220ab6655dc37e90e056adf
SHA1 c6c5b376768aa76dbad4aeb7d530ce11b628ffc5
SHA512 8c65f85a95d271412b767062a02246d7f7d6f486c269fe0862cbc848e5d526f234613e2ed070beb64cafc12e8b9dc59563122b0802688dd8dd2cba8c9744dbd5
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

77.220.64.39:443
69.164.207.140:3388
78.47.139.43:4443
103.244.206.74:33443

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral1/memory/1604-1-0x00000000751A0000-0x00000000751BD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25
PID 1668 wrote to memory of 1604	1668	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c18c1480220ab6655dc37e90e056adf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c18c1480220ab6655dc37e90e056adf.dll,#1
  2⤵
  PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-1-0x00000000751A0000-0x00000000751BD000-memory.dmp

Download