dridex | c8a21f3ba32b9e1557b9146648a3ce2dc39a53e6fc07d58b736b385d9b0b777a

Analysis

max time kernel
50s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
20-01-2021 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6caba7e0bee7373c2c620f1e12b85896.dll
Size

236KB
MD5

6caba7e0bee7373c2c620f1e12b85896
SHA1

b6a881f9f02ed06a24fd3e32b77a9ac84d08131c
SHA256

c8a21f3ba32b9e1557b9146648a3ce2dc39a53e6fc07d58b736b385d9b0b777a
SHA512

e9463b48754c92264dc2b24c89ee63da4d853118e646883c7f9906ca2e2485654b419822bc4912becc9d60557c9cef1d79767b503aec15edc7d7f3696da865c1

Score

10^/10

dridex 111 botnet loader

Malware Config

Extracted

Family

dridex

Botnet

111

52.73.70.149:443

8.4.9.152:3786

185.246.87.202:3098

50.116.111.64:5353

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/1008-3-0x00000000743E0000-0x000000007441D000-memory.dmp	dridex_ldr
behavioral2/memory/1008-5-0x00000000743E0000-0x00000000743FF000-memory.dmp	dridex_ldr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 648 wrote to memory of 1008	648	rundll32.exe	rundll32.exe
PID 648 wrote to memory of 1008	648	rundll32.exe	rundll32.exe
PID 648 wrote to memory of 1008	648	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6caba7e0bee7373c2c620f1e12b85896.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6caba7e0bee7373c2c620f1e12b85896.dll,#1
2⤵
PID:1008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-2-0x0000000000000000-mapping.dmp

Download
memory/1008-3-0x00000000743E0000-0x000000007441D000-memory.dmp

Filesize
244KB

Download
memory/1008-4-0x0000000002BF0000-0x0000000002BF6000-memory.dmp

Filesize
24KB

Download
memory/1008-5-0x00000000743E0000-0x00000000743FF000-memory.dmp

Filesize
124KB

Download