dridex | ae9628344dfef9e22d8bb19fd5001329640ec5573c5503e3ae99788ef7b58f1c

Analysis

max time kernel
122s
max time network
123s
platform
windows10_x64
resource
win10v20201028
submitted
18-11-2020 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ugm5wtx2gif.dll
Size

539KB
MD5

6972a8146a738570e6443ba8b75af1bb
SHA1

480043a771ac2bdde19b0177a0f7ce5db428e8c7
SHA256

ae9628344dfef9e22d8bb19fd5001329640ec5573c5503e3ae99788ef7b58f1c
SHA512

4120227d0fd105d3e7a28a39f151036121ce84ed78cd7a846f133c7ea4e47fc58cf0f102d1e6ba1dc97fcff318597e3d77548822384c4c2603680dacac809f35

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

162.241.44.26:9443

192.232.229.53:4443

77.220.64.34:443

193.90.12.121:3098

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/652-1-0x0000000004000000-0x000000000403D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2212 wrote to memory of 652	2212	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 652	2212	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 652	2212	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ugm5wtx2gif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ugm5wtx2gif.dll,#1
2⤵
PID:652

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-0-0x0000000000000000-mapping.dmp

Download
memory/652-1-0x0000000004000000-0x000000000403D000-memory.dmp

Filesize
244KB

Download