dridex | 9e5b2c5dbdaaebb8571121e82cefaa015ab39c25360035eea4ddd3a44695c34b | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
22-12-2020 12:30

Sharing

Report Analysis Logs

General

Target

4b017ff70c2ed90ff920ad15282f474e.exe
Size

268KB
MD5

4b017ff70c2ed90ff920ad15282f474e
SHA1

7366ee8c886d4d8dbd9f9371bbfc05f745545a66
SHA256

9e5b2c5dbdaaebb8571121e82cefaa015ab39c25360035eea4ddd3a44695c34b
SHA512

2f11fed0aa43bad0b14244264bb23dc71dc893529825769e648a57b504830e543391fe2ab82f411d6260ca737fbe18a897831f512ba1101206199527b34dadc8

Score

10^/10

dridex 20445 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

20445

C2

213.136.94.177:443

91.83.93.219:3389

37.205.9.252:8443

213.192.1.171:4646

rc4.plain

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

Processes:

resource	yara_rule
behavioral1/memory/1152-4-0x0000000000400000-0x0000000000428000-memory.dmp	dridex_ldr

C:\Users\Admin\AppData\Local\Temp\4b017ff70c2ed90ff920ad15282f474e.exe
"C:\Users\Admin\AppData\Local\Temp\4b017ff70c2ed90ff920ad15282f474e.exe"
1⤵
PID:1152

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-2-0x0000000000A2B000-0x0000000000A2C000-memory.dmp

Filesize
4KB

Download
memory/1152-3-0x00000000023D0000-0x00000000023E1000-memory.dmp

Filesize
68KB

Download
memory/1152-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download