Analysis
-
max time kernel
51s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 14:10
General
-
Target
SecuriteInfo.com.Generic.mg.002c56165a0e7836.18308.dll
-
Size
836KB
-
MD5
002c56165a0e78369d0e1023ce044bf0
-
SHA1
78ebfe4167a851bc75d9702aa1aea5efe1514b0c
-
SHA256
a5ffce2a8d98ddc0ccc20744e88443eac323caf1cd8a218b8ccd50bc5ab8f1ac
-
SHA512
bb6796d16c54e3521b4207323e7f774f9469d80b7aeb1d270b9f45034dd26ca801d9f8ed5130994ee0c7e35e084b33b7a90e6eef6295be4b53cf77a61c927d2a
Score
10/10
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
rc4.plain
rc4.plain
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 3 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.002c56165a0e7836.18308.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.002c56165a0e7836.18308.dll2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1388-2-0x0000000000000000-mapping.dmp
-
memory/1388-3-0x0000000073C70000-0x0000000073CAD000-memory.dmpFilesize
244KB
-
memory/1388-4-0x0000000073C70000-0x0000000073CAD000-memory.dmpFilesize
244KB
-
memory/1388-5-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/1388-6-0x0000000073C70000-0x0000000073CAD000-memory.dmpFilesize
244KB