j4r7zap
j4r7zap.dll
539KB
19-11-2020 13:37
19473a4823afb3ca1c966ffed1ee6003
db853d8f738ee15172141315e96644bf6f265d6b
7359fb03e09c8416c7a967f72df483a1b60066434c9e49e0deb4b18cb11e9192
Extracted
| Family | dridex |
| Botnet | 10555 |
| C2 |
162.241.44.26:9443 192.232.229.53:4443 77.220.64.34:443 193.90.12.121:3098 |
| rc4.plain |
|
| rc4.plain |
|
Filter: none
-
Dridex
Description
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
Tags
-
Dridex Loader
Description
Detects Dridex both x86 and x64 loader in memory.
Tags
Reported IOCs
resource yara_rule behavioral1/memory/1632-1-0x0000000000430000-0x000000000046D000-memory.dmp dridex_ldr -
Blocklisted process makes network requestrundll32.exe
Reported IOCs
flow pid process 3 1632 rundll32.exe 6 1632 rundll32.exe -
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Checks whether UAC is enabledrundll32.exe
Tags
TTPs
Reported IOCs
description ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemoryrundll32.exe
Reported IOCs
description pid process target process PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe PID 1068 wrote to memory of 1632 1068 rundll32.exe rundll32.exe
-
C:\Windows\system32\rundll32.exePID:1068rundll32.exe C:\Users\Admin\AppData\Local\Temp\j4r7zap.dll,#1Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exePID:1632rundll32.exe C:\Users\Admin\AppData\Local\Temp\j4r7zap.dll,#1Blocklisted process makes network requestChecks whether UAC is enabled
-
memory/1088-2-0x000007FEF7E60000-0x000007FEF80DA000-memory.dmp
-
memory/1632-0-0x0000000000000000-mapping.dmp
-
memory/1632-1-0x0000000000430000-0x000000000046D000-memory.dmp