Analysis
- max time kernel
17s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
20/01/2021, 00:13
General
- Target 2ksbv.exe
- Sample210120-y331pgwt4x
Score
10/10
Malware Config
Extracted
Family
-
dridex
Botnet
-
10111
C2
-
162.241.44.26:9443
-
185.184.25.234:4664
-
138.201.138.91:3389
rc4.plain
rc4.plain
Signatures
- Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ksbv.exe"C:\Users\Admin\AppData\Local\Temp\2ksbv.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/580-2-0x0000000000400000-0x000000000043D000-memory.dmp
memory/580-4-0x0000000000400000-0x000000000043D000-memory.dmp
memory/580-3-0x0000000000630000-0x000000000066C000-memory.dmp