dridex | b053397f2810775abac160b2c655e8af5b3bc822ee1066e1d01b83e209e07dc5 | Triage™

Analysis

max time kernel
10s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
09/12/2020, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9e6937vcrar.dll
Size 538KB
Sample201209-wtndmm8x3a
SHA256 b053397f2810775abac160b2c655e8af5b3bc822ee1066e1d01b83e209e07dc5
MD5 12e555c7c251e0fa46b28d7b19233cb3
SHA1 e196b42af98d9bc5f31c81a28a3c168730862a2a
SHA512 50570a5cde3b1f60e1b618f7c48b95f9fd824b6b032236ee2451e3cdfb5f24518bceed937d052ed73d4f5e6d20f937f03f8267c1851a4ba8098c5590b38d2156
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/480-3-0x00000000045B0000-0x00000000045ED000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 480	984	rundll32.exe	69
PID 984 wrote to memory of 480	984	rundll32.exe	69
PID 984 wrote to memory of 480	984	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9e6937vcrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9e6937vcrar.dll,#1
  2⤵
  PID:480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-3-0x00000000045B0000-0x00000000045ED000-memory.dmp

Download