ef5ai1p.dll
ef5ai1p.dll
539KB
19-11-2020 18:08
1ba0b20a2d03d8af03a7faa42b06417f
4c528bb2afd93d8cb1199d05dc33d77e08f0ee88
f5951b345050e10fa0d3b70b42e6b56d5a720a7a67c381345e33c145e2ba2452
Extracted
Family | dridex |
Botnet | 10444 |
C2 |
162.241.44.26:9443 192.232.229.53:4443 77.220.64.34:443 193.90.12.121:3098 |
rc4.plain |
|
rc4.plain |
|
Filter: none
-
Dridex
Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
Tags
-
Dridex Loader
Description
Detects Dridex both x86 and x64 loader in memory.
Tags
Reported IOCs
resource yara_rule behavioral1/memory/840-1-0x0000000000360000-0x000000000039D000-memory.dmp dridex_ldr -
Blocklisted process makes network requestrundll32.exe
Reported IOCs
flow pid process 3 840 rundll32.exe 7 840 rundll32.exe -
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Checks whether UAC is enabledrundll32.exe
Tags
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemoryrundll32.exe
Reported IOCs
description pid process target process PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 840 1980 rundll32.exe rundll32.exe
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef5ai1p.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef5ai1p.dll,#1Blocklisted process makes network requestChecks whether UAC is enabled
-
memory/840-0-0x0000000000000000-mapping.dmp
-
memory/840-1-0x0000000000360000-0x000000000039D000-memory.dmp
-
memory/1008-2-0x000007FEF7810000-0x000007FEF7A8A000-memory.dmp