dridex | 01020b0e9a19a67c53ceb2a3da055470fe1fd49b103ebecd4e3ca41639ae147e | Triage™

Analysis

max time kernel
14s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
07/12/2020, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jisfp6lsrar.dll
Size 417KB
Sample201207-k3r2cl13aa
SHA256 01020b0e9a19a67c53ceb2a3da055470fe1fd49b103ebecd4e3ca41639ae147e
MD5 9c48a5b2d13e446e956cac100149ee12
SHA1 1e5a73c061657b54289dcdf030dd6d4819fdeab7
SHA512 21da88688cfda96126e374c7a27b79b51ff26891c14a9d7aea5a3dff6584d59fb1ecb1e839e298f691ec4f96e70194f0fbe3a952da09a4d8d30699f193c35e74
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

104.131.164.93:443
46.101.90.205:4643
27.254.174.84:4443
92.94.251.127:3786

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/2620-3-0x00000000031D0000-0x000000000320D000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2620	2604	rundll32.exe	70
PID 2604 wrote to memory of 2620	2604	rundll32.exe	70
PID 2604 wrote to memory of 2620	2604	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jisfp6lsrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jisfp6lsrar.dll,#1
  2⤵
  PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-3-0x00000000031D0000-0x000000000320D000-memory.dmp

Download