dridex | 8d00cb0248e3933ec12d2e303c058d0dd83eea88fc9191c4ad6a9afaeeb092dd | Triage™

Analysis

max time kernel
40s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
21/12/2020, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81z0m.dll
Size 200KB
Sample201221-lscbhajpae
SHA256 8d00cb0248e3933ec12d2e303c058d0dd83eea88fc9191c4ad6a9afaeeb092dd
MD5 af6bb7c9e0bc2da2228ed0f5891c27d9
SHA1 586789de608e94f7df58d693a794e4cf8ed16d01
SHA512 1cb0f798f3a04fc65e0a89affef7e0edc1cb6ed05ddbb0919ca4868fb6d1abfc195422794905f5014d891897a79fc500e836c3ba26c0c2505b976c891393b86a
MD5 SHA1 SHA512

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

111

C2

51.75.24.85:443
213.202.229.72:3074
202.91.8.121:4643
195.231.69.151:3889

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

resource	yara_rule
behavioral2/memory/652-3-0x0000000073D60000-0x0000000073D7F000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 652	3324	rundll32.exe	69
PID 3324 wrote to memory of 652	3324	rundll32.exe	69
PID 3324 wrote to memory of 652	3324	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81z0m.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81z0m.dll,#1
  2⤵
  PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-3-0x0000000073D60000-0x0000000073D7F000-memory.dmp

Download