dridex | e64e3395c17e8de856a49a6c16eec63b95d876b957b8e2ff12946f8a93a6faad

General

Target

a804ed88ea8ab0b0136488a6302626ba.exe
Size

637KB
MD5

a804ed88ea8ab0b0136488a6302626ba
SHA1

27e4371f7c0892be905d63661ead63ea9683b95b
SHA256

e64e3395c17e8de856a49a6c16eec63b95d876b957b8e2ff12946f8a93a6faad
SHA512

a887836f6d277eba77f47e716b571c754dc33b19d237b2c182fc702bada6003801b55288953755ed766157a321bc64e14cc5ade9e9358068bcf5530b61cdaeb7

Score

10^/10

dridex 10555 botnet loader ransomware

Malware Config

Extracted

Family

dridex

Botnet

10555

C2

77.220.64.37:443

80.86.91.27:3308

5.100.228.233:3389

46.105.131.65:1512

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1756-10-0x0000000000450000-0x000000000048D000-memory.dmp	dridex_ldr

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1756 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

pid	process
1756	regsvr32.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

a804ed88ea8ab0b0136488a6302626ba.exeWScript.execmd.exe

description	pid	process	target process
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 2024 wrote to memory of 1184	2024	a804ed88ea8ab0b0136488a6302626ba.exe	WScript.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1184 wrote to memory of 1892	1184	WScript.exe	cmd.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe
PID 1892 wrote to memory of 1756	1892	cmd.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\a804ed88ea8ab0b0136488a6302626ba.exe
"C:\Users\Admin\AppData\Local\Temp\a804ed88ea8ab0b0136488a6302626ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\inst\117.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\inst\eps1.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -s pspvl.dll
4⤵
- Loads dropped DLL
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\inst\117.vbs
MD5
8de1f00c6064ce91fcb28f729a6f6371

SHA1
742e468c97d4cd5fe86d21f0e117e61c4da1ba4c

SHA256
3a2e68a8385fc5f85c2152e5bd55e2fc293955c1126f494fb778735dc92b65d1

SHA512
6bea0198d9ee1f9d4f7cb5a0baf659702f6c07b435d158fcbc0b8f9a1475208404a13b4e41926b0764f434d25ed83d2a615a93667fa8e41caf62be23ae10230a

Download Submit
C:\inst\eps1.bat
MD5
9ae39daeea77ba3fbb1e51a6a0e4cabd

SHA1
4e2538e7b8adfa46db64cf99ab178bd92ad5b29d

SHA256
96458f375a5c1331f7b44d4f0402402f642889989b44db5817135871d842aa0d

SHA512
b4648100d4b5c55cc8a3fac79fa0b827bd2e6213a63d433a616eca25678cc4816162add5f99bc6c9cf02a44d525035d3a69b63679d3e1b4012a114aa2dce1f42

Download Submit
C:\inst\pspvl.dll
MD5
93b3d78c457ce029a383590d6d6f7c6e

SHA1
629a368dbf26925714172b616a08ee65ca839f5e

SHA256
b3e57d1a48a868416c41809022790266f7fc0db89acc635e97d63428144c23a8

SHA512
6fbd1d52fac9348b5fd7ffe3943544026006198f683334e58a96de036f3c5c890e4037e0dfc1144b9523ca2b506e5aca985b6a9922a56eb96185394dd47b231b

Download Submit
\inst\pspvl.dll
MD5
93b3d78c457ce029a383590d6d6f7c6e

SHA1
629a368dbf26925714172b616a08ee65ca839f5e

SHA256
b3e57d1a48a868416c41809022790266f7fc0db89acc635e97d63428144c23a8

SHA512
6fbd1d52fac9348b5fd7ffe3943544026006198f683334e58a96de036f3c5c890e4037e0dfc1144b9523ca2b506e5aca985b6a9922a56eb96185394dd47b231b

Download Submit
memory/240-11-0x000007FEF6510000-0x000007FEF678A000-memory.dmp

Filesize
2.5MB

Download
memory/1184-2-0x0000000000000000-mapping.dmp

Download
memory/1184-6-0x00000000027F0000-0x00000000027F4000-memory.dmp

Filesize
16KB

Download
memory/1756-7-0x0000000000000000-mapping.dmp

Download
memory/1756-10-0x0000000000450000-0x000000000048D000-memory.dmp

Filesize
244KB

Download
memory/1892-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing