dridex | 9e7b660bda0c8106ff7345d4bae214da27f542f7f81fa1df61ce82cc6a6825cc | Triage™

Analysis

max time kernel
22s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
10/12/2020, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tdskvr4y6.rar.dll
Size 525KB
Sample201210-76k8p1xkte
SHA256 9e7b660bda0c8106ff7345d4bae214da27f542f7f81fa1df61ce82cc6a6825cc
MD5 3de3cc4de83ab13b16b089e9ccbebeba
SHA1 36edc752c8d0cbe4eaf15f0de56ef46084fb8672
SHA512 4e2d427da8a89d641bafd5cae6169fdc24c3c2c473ca54b7bd6b6d61fa9dccd732cad0e05630711de09d219672c1b4308ca6282f9a0390e77a53afb8a555a722
MD5 SHA1 SHA512

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/3228-3-0x00000000046C0000-0x00000000046FD000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3228	744	rundll32.exe	66
PID 744 wrote to memory of 3228	744	rundll32.exe	66
PID 744 wrote to memory of 3228	744	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tdskvr4y6.rar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tdskvr4y6.rar.dll,#1
  2⤵
  PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3228-3-0x00000000046C0000-0x00000000046FD000-memory.dmp

Download