dridex | f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e | Triage™

Analysis

max time kernel
41s
max time network
124s
platform
windows10_x64
resource
win10v20201028
submitted
08/12/2020, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c1ea137c6275b4de45be3a7943831f2.dll
Size 160KB
Sample201208-q1etffnnb2
SHA256 f0ecc44eacafdb97e9a84785bbdcffce312393c0e219d27040b42a3d4c93f45e
MD5 6c1ea137c6275b4de45be3a7943831f2
SHA1 4a57b09d98986c21bcd5d3ce6d770247badfe37d
SHA512 4d757d3f194de4f85e77fc55893bdbdc87187f4df92b3f7b9f840d22b22d5cb9b8e225001cf98c6a180ff322102580da3d4be55aea9119f3bbe1c8be39209321
MD5 SHA1 SHA512

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

111

C2

169.255.216.36:443
87.106.89.36:3389
27.254.174.84:4443
92.94.251.127:3786

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3748-3-0x0000000074270000-0x000000007428F000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3748	3980	rundll32.exe	71
PID 3980 wrote to memory of 3748	3980	rundll32.exe	71
PID 3980 wrote to memory of 3748	3980	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c1ea137c6275b4de45be3a7943831f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c1ea137c6275b4de45be3a7943831f2.dll,#1
  2⤵
  PID:3748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3748-3-0x0000000074270000-0x000000007428F000-memory.dmp

Download