dridex | 2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20 | Triage™

Analysis

max time kernel
39s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
17/12/2020, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d74b99326b035bb901dc95b93f885ab4.dll
Size 164KB
Sample201217-prmghyzwpn
SHA256 2542d8801568e29aef85b91ee8ea89ce20bfbbb46954941745c88f68d6c9eb20
MD5 d74b99326b035bb901dc95b93f885ab4
SHA1 ba19b1227be8345ff69f7f30acc7bdcae74087c5
SHA512 2cd0d065d1f9fa0fc47cf31ffe46ce59f5e4699975767d05ce0b8fb20b161e7125c559cc08677f19cf31c5e89fe66038b939609687b1b68bffccf10ac38d16ba
MD5 SHA1 SHA512

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

111

C2

172.86.186.22:3889
46.105.131.78:14431
103.244.206.74:33443
139.162.53.147:4443

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/1384-3-0x0000000073F40000-0x0000000073F5F000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 1384	412	rundll32.exe	71
PID 412 wrote to memory of 1384	412	rundll32.exe	71
PID 412 wrote to memory of 1384	412	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74b99326b035bb901dc95b93f885ab4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74b99326b035bb901dc95b93f885ab4.dll,#1
  2⤵
  PID:1384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-3-0x0000000073F40000-0x0000000073F5F000-memory.dmp

Download