dridex | 84d0bbe26d243e5ad7ee7bb17f842a67a3e2667caa4839b9434250cf84dbe401 | Triage™

Analysis

max time kernel
11s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
03/12/2020, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iejbl7rar.dll
Size 416KB
Sample201203-x7psmr6fej
SHA256 84d0bbe26d243e5ad7ee7bb17f842a67a3e2667caa4839b9434250cf84dbe401
MD5 378dc4defcbf1b540934de4b8f94ba24
SHA1 de1679c5cd1cd63515c44eeef577bb05f4b9027c
SHA512 501bd9ee266f86e7e76ce1283d313a3b6939455477db31ef87442a60ef595ee3399c409e751433fdf87eca708e86cc3e1dc9985c72d981aa5aef8f2d02bb11dc
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

185.59.223.86:443
123.231.252.10:4646
85.25.109.116:3889
91.83.93.89:4643

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1424-3-0x0000000003190000-0x00000000031CD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1424	1192	rundll32.exe	70
PID 1192 wrote to memory of 1424	1192	rundll32.exe	70
PID 1192 wrote to memory of 1424	1192	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iejbl7rar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\iejbl7rar.dll,#1
  2⤵
  PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-3-0x0000000003190000-0x00000000031CD000-memory.dmp

Download