dridex

General

Target
hy9x6wzip.dll
Size 311KB
Sample210111-2ngx67kcba
SHA256 960a1e2b0409907409403684b842ddccc1bb3369efaf5881fea9d1da51599717
MD5 153526d29ec2007bab82e802476a4de8
SHA1 6ad4255289c294c1fb40d9b016bf9a3910acd2d7
SHA512 87cc56f173494817bc097959d6288880971045df3be3c881f62dd72c045efa55a974fa2a6538518e62487374abdc060585fc32c53565be686516def39bbadc7e
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

dridex

Botnet

10444

C2

77.220.64.37:443
80.86.91.27:3308
5.100.228.233:3389
46.105.131.65:1512

rc4.plain

Targets

- Target
  hy9x6wzip.dll
- Size 311KB
- SHA256 960a1e2b0409907409403684b842ddccc1bb3369efaf5881fea9d1da51599717
- MD5 153526d29ec2007bab82e802476a4de8
- SHA1 6ad4255289c294c1fb40d9b016bf9a3910acd2d7
- SHA512 87cc56f173494817bc097959d6288880971045df3be3c881f62dd72c045efa55a974fa2a6538518e62487374abdc060585fc32c53565be686516def39bbadc7e
- MD5 SHA1 SHA512
Score

10^/10

dridex 10444 botnet discovery evasion loader trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Dridex Loader

Blocklisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2