Analysis
-
max time kernel
52s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 23:54
General
-
Target
SecuriteInfo.com.Trojan.Dridex.735.2669.7089.dll
-
Size
848KB
-
MD5
f9c2f9623ef10ab7afa11cc2243b3261
-
SHA1
e4d8806381f95f0fab57f23e52120a0948912c67
-
SHA256
3324da18d8d14d4dff166e4af1a8922f177dd675c3a69c266bd4b297ff1f4039
-
SHA512
8eada9ca845dff3a91c5c238319b4bbd1a6ab03d89d61bbfd863bd66c1b18af7a2fc1a3ea87b4b590d5d23882cce92278a8bdc4b1748de9a8989519589032032
Score
10/10
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 3 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.2669.7089.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Dridex.735.2669.7089.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3544-2-0x0000000000000000-mapping.dmp
-
memory/3544-3-0x0000000073C10000-0x0000000073C4D000-memory.dmpFilesize
244KB
-
memory/3544-4-0x0000000073C10000-0x0000000073C4D000-memory.dmpFilesize
244KB
-
memory/3544-5-0x0000000002FD0000-0x0000000002FD1000-memory.dmpFilesize
4KB
-
memory/3544-6-0x0000000073C10000-0x0000000073C4D000-memory.dmpFilesize
244KB