dridex | aacb087e8f85cfd1b69dabd575e8fa48ca589ce69cc6a90e02abc96ea5731a9f | Triage™

Analysis

max time kernel
13s
max time network
65s
platform
windows10_x64
resource
win10v20201028
submitted
03/12/2020, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.BScope.Trojan.Encoder.28560.dll
Size 416KB
Sample201203-aw7ayntvhe
SHA256 aacb087e8f85cfd1b69dabd575e8fa48ca589ce69cc6a90e02abc96ea5731a9f
MD5 9f6d00e6c8174a71720060b5cf909216
SHA1 ba822a8250b3b16d1ddb8b8b94e2ddd610ae560c
SHA512 21374062e5a38b6aef48575b5f99837443df7f202441687941451a0ce7d5fa92ee01115689e524de93706042219f4dbe64c10137d9dc45c0c61483e81299c4e4
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

185.59.223.86:443
123.231.252.10:4646
85.25.109.116:3889
91.83.93.89:4643

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1048-3-0x0000000000960000-0x000000000099D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1048	828	rundll32.exe	69
PID 828 wrote to memory of 1048	828	rundll32.exe	69
PID 828 wrote to memory of 1048	828	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Trojan.Encoder.28560.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Trojan.Encoder.28560.dll,#1
  2⤵
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-3-0x0000000000960000-0x000000000099D000-memory.dmp

Download