dridex | 296ffd7b9cd78965e7a97241b9fd2b54eaf77ecf0c7546f7fb7ef5e1f2761a4a

Analysis

max time kernel
81s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uqfsuTJQB2R.dll
Size

236KB
MD5

076868d4277b05ce952654d0eb527bb2
SHA1

aa91e36021e936f0a2685ccfd6aca58747c2c4b9
SHA256

296ffd7b9cd78965e7a97241b9fd2b54eaf77ecf0c7546f7fb7ef5e1f2761a4a
SHA512

cf2e4befae1ed888725bcc83db9b0d1811e7ac0adaca4be7366674b99dbbe6a516f5ae81ebe33b475e5ff43c72970a68461f18cf35da22886de7b84319221963

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

111

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1508-3-0x00000000754A0000-0x00000000754BF000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1508	2028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uqfsuTJQB2R.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uqfsuTJQB2R.dll,#1
2⤵
PID:1508

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-2-0x0000000000000000-mapping.dmp

Download
memory/1508-3-0x00000000754A0000-0x00000000754BF000-memory.dmp

Filesize
124KB

Download