Analysis
-
max time kernel
50s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 14:10
General
-
Target
SecuriteInfo.com.Generic.mg.fbb5fe400b44ef9a.30739.dll
-
Size
836KB
-
MD5
fbb5fe400b44ef9a537fbd4f057acb55
-
SHA1
7704694476b1106feb02969fa004d0e05b06b3f5
-
SHA256
9307d30af9d01001c8f0fc5cbc51ebe29925c55110b5987b6bd0c9ce453834be
-
SHA512
491aef5200184725406e36c5b8a353401d4b21c2f3f7c39c8b1d9043a66426a8b8f6c2e8f351577b16e014375aebcab45e900ce9d99ae74d1fade33a6705a9c6
Score
10/10
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 3 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.fbb5fe400b44ef9a.30739.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.fbb5fe400b44ef9a.30739.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4992-2-0x0000000000000000-mapping.dmp
-
memory/4992-3-0x00000000734D0000-0x000000007350D000-memory.dmpFilesize
244KB
-
memory/4992-4-0x00000000734D0000-0x000000007350D000-memory.dmpFilesize
244KB
-
memory/4992-5-0x0000000002FE0000-0x0000000002FE1000-memory.dmpFilesize
4KB
-
memory/4992-6-0x00000000734D0000-0x000000007350D000-memory.dmpFilesize
244KB