dridex | 9b939f0d1dabceba231ab0ca036818ef10a813775d9a12cfc3e854819d7a7cc3

Analysis

max time kernel
9s
max time network
118s
platform
windows10_x64
resource
win10v20201028
submitted
20-11-2020 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed15f59b17a7ef869377647bbf500718.dll
Size

551KB
MD5

ed15f59b17a7ef869377647bbf500718
SHA1

72a2b09a4cd4c517ab6897386149d6aca291a509
SHA256

9b939f0d1dabceba231ab0ca036818ef10a813775d9a12cfc3e854819d7a7cc3
SHA512

63728cd6cfbbb15256bea25d48855e7ffe8eb83efca81d126863abe3ba2132e2292a35aafd18b827b1b47e48932272724ef65b0eda5a23a993165e632cab77e3

Score

10^/10

dridex 10555 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10555

162.241.44.26:9443

192.232.229.53:4443

77.220.64.34:443

193.90.12.121:3098

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/4036-1-0x0000000000C80000-0x0000000000CBD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3936 wrote to memory of 4036	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 4036	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 4036	3936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed15f59b17a7ef869377647bbf500718.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed15f59b17a7ef869377647bbf500718.dll,#1
2⤵
PID:4036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4036-0-0x0000000000000000-mapping.dmp

Download
memory/4036-1-0x0000000000C80000-0x0000000000CBD000-memory.dmp

Filesize
244KB

Download